Still running into this. One thought: Instead of changing all of those 'LogFile = messages' lines to 'LogFile = syslog', why not do a distribution override (/usr/share/logwatch/dist.conf/logfiles/messages.conf) to cause 'messages' to instead look at /var/log/syslog et al?
Still running into this. One thought: Instead of changing all of those 'LogFile = messages' lines to 'LogFile = syslog', why not do a distribution override (/usr/share/ logwatch/ dist.conf/ logfiles/ messages. conf) to cause 'messages' to instead look at /var/log/syslog et al?