Logwatch is an invaluable tool. It will sum up your error logs and send them to you in an email on a daily basis, if you set up a cron job for it.
I have taken to setting it up on every *ix server I manage.
But the daily logwatch entries from my CentOS web server that I lease were huge, ungainly monsters, due to reporting the activity of every bot (thanks again, Microsoft) that was vainly attempting to use my server to send out the latest VI4AGR4 spam.
I'm more concerned with attempted ssh breakins, Clamav scan results, FTP activity, etc.
So I started doing Google searches for stuff like logwatch ignore courier mail.
Nada.
Fortunately, I've gotten geeky enough over the years to go digging through conf files on my own, and I solved the problem.
I found /usr/share/logwatch/default.conf/services/courier.conf among the services conf files. I found this line:
$courier_enable=1
Set it to 0.
My next logwatch email was a slim, trim report with nary a trace of mail errors.
Hope this helps someone else!
