logwatch ebuild will remove logwatch.pl entry in root crontab when logwatch package get updated. this happen due to lack to controls in the ebuild files. The following code (replacement for pkg_postinst() and pkg_postrm() ) fixes this behaviour: please apply to all the existing logwatch ebuilds in the portage tree (4.2.1 and 4.3.1 currently) pkg_postinst() { einfo "creating a symlink for configuration directory..." ln -snf ${ROOT}usr/share/logwatch/conf ${ROOT}etc/logwatch einfo "adding executable to path..." ln -sf ${ROOT}usr/share/logwatch/scripts/logwatch.pl ${ROOT}usr/bin/logwatch # this will avoid duplicate entries in the crontab if [ "`grep logwatch.pl ${ROOT}var/spool/cron/crontabs/root`" == "" ]; then einfo "adding to cron..." echo "0 0 * * * ${ROOT}usr/share/logwatch/scripts/logwatch.pl 2>&1 > /dev/null" >> ${ROOT}var/spool/cron/crontabs/root fi } pkg_postrm() { # this fixes a bug when logwatch package gets updated if [ "`ls -d ${ROOT}var/db/pkg/sys-apps/logwatch* | wc -l | tail -c 2`" -lt 2 ]; then sed "/^0.*\/usr\/share\/logwatch\/scripts\/logwatch.*null$/d" ${ROOT}var/spool/cron/crontabs/root > ${ROOT}var/spool/cron/crontabs/root.new mv --force ${ROOT}var/spool/cron/crontabs/root.new ${ROOT}var/spool/cron/crontabs/root fi } a fixed 4.3.2 ebuild is also being uploaded for bug #16016 Reproducible: Always Steps to Reproduce: 1. 2. 3.
Fixed.
