LogwatchFilesystemScript

You will need to use command "df -h | logger" in a cron job that runs BEFORE logwatch runs on your loghost. This will give the output of the Filesystem correctly in the report. Logwatch generally runs at 4AM.

/etc/log.d/scripts/services/logger.conf

###########################################################################
# ------------------------------------------------------------------------
###########################################################################

# You can put comments anywhere you want to.  They are effective for the
# rest of the line.

# this is in the format of <name> = <value>.  Whitespace at the beginning
# and end of the lines is removed.  Whitespace before and after the = sign
# is removed.  Everything is case *insensitive*.

# Yes = True  = On  = 1
# No  = False = Off = 0

Title = "Local Filesystem"

# Which logfile group...
LogFile = messages

/etc/log.d/scripts/services/logger

#!/usr/bin/perl
# Ffeil er mwn ddal pob peth o servers NT
#
# Ar hyn o bryd, just rhester o services NT mae hwn yn ddal, ac yna
# gyrru yr output i logwatch
#

while(defined($line=<STDIN>))
{
        chomp $line;
        next if ($line eq '');
        if ($line=~ m/^... .. ..:..:.. ([a-z,A-Z,0-9,\.]+) logger: ([\s\S]*)/)
        {
                my $match=$2;
                if (($match=~ m/^Filesystem /) or ($match=~ m/^\//) or ($match=~ m/^none/))
                {
                        print "$match\n";
                }
        }
}