Runs the mk_logwatch of the Checkmk agent as another user through sudo, so logfiles that the agent user cannot read are still monitored. The typical case is a non-root agent deployment, where mk_logwatch has to read the logfiles as root.

It does not replace mk_logwatch and it does not ship a copy of it. The rule "Text logfiles (Linux, UNIX, Windows)" keeps deploying and configuring mk_logwatch as before, logwatch.cfg and logwatch.d are untouched, and the output reaches the agent unchanged, so the existing logwatch services keep working.

The included bakery rule "Run mk_logwatch as another user (sudo)" deploys the wrapper and its configuration. On its first run the wrapper takes the execute bit off the mk_logwatch that the agent package delivered, so the agent does not run it a second time as the agent user and report every message twice. Only the mode of that file is changed - it is not moved, renamed or deleted. An agent update puts the bit back and the next agent call removes it again. Every change is written to mk_logsudo.log in the state directory of the agent, together with the command to undo it.

Prerequisite: the agent user needs a sudo rule for the wrapper. The bakery rule writes it to /etc/sudoers.d/check_mk_mk_logsudo when the agent user and the agent plug-in directory are configured; an agent that runs as root needs none. If sudo refuses the call, the plug-in reports this in the agent output together with the exact line that is needed, and "mk_logsudo.py --diag" prints it on the host as well.

Supported: Checkmk 2.4 and 2.5, Linux only (no Windows, AIX or Solaris), Python 3.6 or newer on the monitored host. Note that sudo does not pass the address of the Checkmk server on, so mk_logwatch keeps one state file instead of one per server - this only matters when several Checkmk servers query the same host.