
You can customize the output of logwatch by modifying variables in the
/etc/logwatch/conf directory.

Default values are specified in the /usr/share/logwatch/default.conf
directory.  Your distribution may have set additional defaults in the
/usr/share/logwatch/dist.conf directory.  All the variables available
are declared in the files under these directories.  You can change the
default values to modify how or what is displayed with logwatch.

There are two mechanisms for customizing the variables:

1. The /etc/logwatch/conf directory is first searched for files with the
   same name and relative location as the
   /usr/share/logwatch/default.conf directory.  Variables declared in
   these files override the defaults.

   For example, if file /etc/logwatch/conf/services/sendmail.conf has the
   single entry:
        $sendmail_unknownusersthreshold = 5
   then the threshold for unknown users is set to five instead of the
   default of one.  All other parameters are not modified.

2. The /etc/logwatch/conf/override.conf file is then searched.  The first
   field in each line may be one of the following:

      #
           This character indicates that the rest of the line is a
           comment, and is ignored.

      logwatch:
           This string indicates that the rest of the line is a global
           configuration option, and uses the same syntax as the
           /usr/share/logwatch/default.conf/logwatch.conf file.

      services/service_name:
           (Where service_name is the name of a service.)  This string
           indicates that the rest of the line is a configuration
           option for the specified service, and uses the same syntax
           as the /usr/share/logwatch/default.conf/services files.

      logfiles/service_name:
           (Where service_name is the name of a service.)  This string
           indicates that the rest of the line is a configuration
           option for the specified service, and uses the same syntax
           as the /usr/share/logwatch/default.conf/logfiles files.


   For example, if the file /etc/logwatch/conf/override.conf has the single
   entry:
        logwatch: Detail = High
   then the default detail level for all services will be set to High.


In general, setting a variable overrides any value previously set.
However, the following variables are cummulative:
- In logwatch.conf:  LogFile, Service
- In services/service_name.conf: LogFile
- In services/service_name.conf: LogFile, Archive

To remove all previous declarations of that variable, set the
variable to the empty string.

For example, in file override.conf, the following declaration:

logfiles/messages: LogFile = syslog

will analyze the syslog file (in addition to the default messages file)
for certain services.  But the following two declarations combined:

logfiles/messages: LogFile = 
logfiles/messages: LogFile = syslog

will cause the messages file to be ignored for those same services,
and only the syslog file will be used.
