Package: logwatch Version: 7.5.5-1 Severity: important Dear Maintainer,
I recently discovered that logwatch did not report a systemd service (snapper-timeline.service) that failed repeatedly on my system. Looking through the script /usr/share/logwatch/scripts/services/systemd I determined that the reason for this is that the script makes wrong assumptions about what the log entries should look like - or assumptions that don't apply to a service of the type 'simple'. The comments within the script explain the logic: > # Failure will generate multiple messages like: > # Feb 5 16:37:50 hostname systemd: ansible-pull.service: main process > exited, code=exited, status=2/INVALIDARGUMENT > # Feb 5 16:37:50 hostname systemd: Failed to start Run ansible-pull on boot. > # Feb 5 16:37:50 hostname systemd: Unit ansible-pull.service entered failed > state. > # Feb 5 16:37:50 hostname systemd: ansible-pull.service failed. and a few lines further down: > # These events will be caught with the Unit X entered failed state message So, everything other than "Unit {} entered failed state." will be ignored. The problem here is that type simple services will not trigger this log message when they fail, see this example: $ journalctl -u snapper-timeline.service -S 2023-02-16 -U 2023-02-17 -- Journal begins at Fri 2022-12-02 07:02:42 CET, ends at Tue 2023-02-28 01:24:53 CET. -- Feb 16 03:05:29 HomeSrv systemd[1]: Started Timeline of Snapper Snapshots. Feb 16 03:05:43 HomeSrv systemd-helper[2690]: running timeline for 'archive'. Feb 16 03:05:44 HomeSrv systemd-helper[2690]: running timeline for 'documents'. Feb 16 03:05:44 HomeSrv systemd-helper[2690]: running timeline for 'home'. Feb 16 03:05:44 HomeSrv systemd-helper[2690]: running timeline for 'photos'. Feb 16 03:05:44 HomeSrv systemd-helper[2690]: IO Error (.snapshots is not a btrfs subvolume). Feb 16 03:05:44 HomeSrv systemd-helper[2690]: timeline for 'photos' failed. Feb 16 03:05:44 HomeSrv systemd-helper[2690]: running timeline for 'root'. Feb 16 03:05:45 HomeSrv systemd[1]: snapper-timeline.service: Main process exited, code=exited, status=1/FAILURE Feb 16 03:05:45 HomeSrv systemd[1]: snapper-timeline.service: Failed with result 'exit-code'. As the log message "Unit {} entered failed state." doesn't appear here, the failure of the unit is never reported by logwatch (snapper-timeline.service, in this example, is a simple service). I would have expected logwatch would catch such failures and report them and I think the script should be changed to look for messages that actually appear for all unit types in case of failure. Thanks and regards, Timo -- System Information: Debian Release: 11.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable'), (400, 'proposed-updates') Architecture: amd64 (x86_64) Kernel: Linux 5.10.0-21-amd64 (SMP w/4 CPU threads) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages logwatch depends on: ii msmtp-mta [mail-transport-agent] 1.8.11-2.1 ii perl 5.32.1-4+deb11u2 Versions of packages logwatch recommends: ii libdate-manip-perl 6.83-1 ii libsys-cpu-perl 0.61-2+b6 ii libsys-meminfo-perl 0.99-1+b5 logwatch suggests no packages. -- no debconf information Thank you for using reportbug