Logwatch not sending email

Rocky Linux version 8.6
Latest logwatch
mailx installed
postfix installed

mail -s test email@example.com works.
postfix works.

I cannot figure out why logwatch does not send emails.

What am I missing?

I’m using sendmail so just trying to reverse think how it works when you use alternate mailer daemon. When I “ls -la /usr/sbin/sendmail” it shows it to be a link to “/etc/alternatives/mta” which is itself a link that points back to “/usr/sbin/sendmail.sendmail”. So I think “mta” has to point to your mailer daemon.
Alternatively you could edit “/etc/logwatch/conf/logwatch.conf” to point to your mailer daemon directly. The defaults are in “/usr/share/logwatch/default.conf/logwatch.conf”

  1. Is logwatch actually running?
  2. Check the postfix logs, is anything attempted to be sent? If so, where to? Is it being rejected as spam?


Logwatch runs as a cron job not as a systemd service. It should be installed automatically in “/etc/cron.daily/” whence it runs at some arbitrary time each morning.
So if the user did not wait till the next day after install there would be no logwatch mail. You can kick start it by running as root:


to test.

Thank you very much for taking the time to reply and help. I do appreciate it much.

Did a check with alternatives and got the following. And I think it looks correct because postfix is installed and working.

]# alternatives --config mta

There is 1 program that provides 'mta'.

  Selection    Command
*+ 1           /usr/sbin/sendmail.postfix

Enter to keep the current selection[+], or type selection number:

Thank you for taking the time to reply and help. I do appreciate it much.

logwatch is a cron.daily job so it runs once a day. I think 4am.

The strange thing about Rocky Linux is that there is no /var/log/maillog file.

The only way I am aware to check if postfix received the mail is to use journalctl -f.
Unfortunately nothing is sent to postfix.

When using mail -s testing name@example.com, postfix gets it and is sent out.

Tested runing /etc/cron.daily/0logwatch no errors but no email as well.

I wonder, could this be because so how this install does not have the normal log files like maillog and logwatch got nothing to send out.

Check /etc/aliases or wherever your aliases file is and make sure root is set to go to your email address, something like:

root: myemail@mydomain.com

after this, run newaliases to update it and postfix reload. Also check under /var/spool/mail as if the aliases or postfix wasn’t configured correctly, it will be delivering locally here, probably to root.

Is rsyslog installed and running? If you’ve built the server from the minimal ISO it’s not installed by default. Expected logfiles not existing in /var/log/ always flags this up for me.


1 Like

Thank you for replying and helping. I do appreciate it.

Did the check on the alias and it is good.

Just to be sure did the following and I received the email.
mail -s testing root

Alias is working good.

Yes Yes Yes!!!

The server was built from the minimal ISO and rsyslog was not installed.

Just installed rsyslog. Enabled and started it.

Now the /var/log/maillog file is there with all the stuff from postfix.

Ran /etc/crond.daily/0logwatch and I am receiving the emails from logwatch.


It is working.

Thank you very much for helping. Could not have figured this out without your help.

Thank you again for helping.

1 Like

No problem, it’s bitten me in the a** more than once on a new server build.


The minimal ISO has only ‘baseos’ packages. The rsyslog is not the only package that is in ‘appstream’ and is included in “the usual yum groups”.

It is probably a good move to (re)install the (environment) group(s) once system has network. Better yet, not rely solely on those groups, but have a list of necessary packages and use some config management tool to ensure that systems have what you need.

Thank you for the advice. I will look into ansible for possible config management.