Debian10.13 : logwatch ,Disk Usage Check Script

1. Disk Usage Check Script

1.1 Script Creation

# cd /opt/script/
# vi disk_capacity_check.sh

Contents of disk_capacity_check.sh
Configured to notify when disk usage exceeds 80%.

#!/bin/bash

#Designation of e-mail address to be notified
MAIL="[your mailaddress]"

DVAL=`/bin/df / | /usr/bin/tail -1 | /bin/sed 's/^.* \([0-9]*\)%.*$/\1/'`

if [ $DVAL -gt 80 ]; then
echo "Disk usage alert: $DVAL %" | mail -s "Disk Space Alert in `hostname`" $MAIL
fi

# chmod 700 disk_capacity_check.sh

1.2 Execution Confirmation

①Check current utilization

# df -h

It appears as follows

Filesystem      Size  Used Avail Use% Mounted on
udev            970M     0  970M   0% /dev
tmpfs           197M   23M  175M  12% /run
/dev/sda1        19G  3.8G   14G  22% /
tmpfs           985M     0  985M   0% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
tmpfs           985M     0  985M   0% /sys/fs/cgroup
tmpfs           197M     0  197M   0% /run/user/1000

②Create a dummy file to have at least 80% utilization (in the example, it is named "dummyfile" and is about 13G)

# dd if=/dev/zero of=dummyfile bs=1M count=13000

③confirmation

# df -h

Confirmation that it is 80% or higher

④Run disk space check script

# /opt/script/disk_capacity_check.sh

You will receive an e-mail to the e-mail address you have set up with the body of the message as "Disk usage alert : 94%".

⑤Delete the "dummyfile" you created.

# rm dummyfile

⑥Periodic Execution Setting

# crontab -e
30 2 * * * /opt/script/disk_capacity_check.sh

2. Log analysis tool logwatch installed

2.1 logwatch Install

# apt -y install logwatch

2.2 Edit logwatch configuration file

①Copy default configuration file

# cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/

②Change email address, etc.

# vi /etc/logwatch/conf/logwatch.conf
Line 54 :
#MailTo = root   ←　Comment out and add the following
MailTo =[your mailaddress] 
Line 87 :
Detail = High

2.3 Creating Directories

There is no directory used by the cache, so create one.

# mkdir /var/cache/logwatch

2.4 operation check

When logwatch is installed, cron is registered by default, so you will receive daily report emails.
If you want to check it immediately, do the following

# /etc/cron.daily/00logwatch