Debian11.3 : Disk Usage Check、Logwatch

1. Introduce disk usage check script

1.1 Scripting

# cd /opt/script/
# vi
Contents of


#Email Address for Notification
MAIL="<your mailaddress> "

DVAL=`/bin/df / | /usr/bin/tail -1 | /bin/sed 's/^.* \([0-9]*\)%.*$/\1/'`

if [ $DVAL -gt 80 ]; then
echo "Disk usage alert: $DVAL %" | mail -s "Disk Space Alert in `hostname`" $MAIL

# chmod 700

1.2 Execution check

①Check current usage

# df -h


Filesystem                                        Size    Used    Avail    Use%   Mounted on
tmpfs                                              390M    1.6M   388M     1%    /run
/dev/mapper/ubuntu--vg-ubuntu--lv  9.8G     4.9G    4.4G   53%    /
tmpfs                                               1.9G         0     1.9G     0%   /dev/shm
tmpfs                                               5.0M         0     5.0M     0%  /run/lock
/dev/sda2                                         1.8G    125M    1.5G     8%  /boot
tmpfs                                               390M     4.0K   390M     1%  /run/user/1000

②Create a dummy file (in the example, it is called "dummyfile" and is about 4G) so that the utilization is 80% or more.

# dd if=/dev/zero of=dummyfile bs=1M count=4000


# df -h

Run it and make sure it is above 80%.

④Run disk space check script

# /opt/script/

You will receive an e-mail to the e-mail address you have set up with the body of the message as "Disk usage alert : 95%".

⑤Delete the "dummyfile" you created.

# rm dummyfile

⑥Periodic Execution Setting

# crontab -e
30 2 * * * /opt/script/

2. Log analysis tool logwatch installed

2.1 Install logwatch

# apt -y install logwatch

2.2 Edit logwatch configuration file

①Copy the default configuration file

# cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/

②Change the destination of your email, etc.

# vi /etc/logwatch/conf/logwatch.conf
# Line 50
#MailTo = root   ← Comment out and add the following
MailTo =<your mailaddress>  ← Mailing address
# Line 83
Detail = High

2.3 Creating Directories

There is no directory used by the cache, so create one.

# mkdir /var/cache/logwatch

2.4 operation check

When logwatch is installed, cron is registered by default, so daily report emails are sent
If you want to check it immediately, do the following

# /etc/cron.daily/00logwatch