rsyslog and logwatch don’t play well together
Notice a hell of a lot fewer log messages being reported since you’ve upgraded to a modern syslog supporting RFC 3339-style high-precision timestamps? Yeah, me too.
It seems as though logwatch doesn’t support these timestamps, so it silently filters out all messages recorded by my rsyslog daemons. What’s worse is that I can’t easily figure out a way to disable that behavior. It’s implemented using an executable filter, and — while there’s plenty of documentation about how to override configuration in /etc/logwatch — there’s no documentation about how to *remove* a filter.
Oh well. I never much liked logwatch, anyway. I mostly don’t like any log monitoring scheme that requires me to read through hundreds of daily e-mails that almost always report everything is normal. That’s not sustainable…