Jon Daley
2011-Nov-04 16:20 UTC
[Logcheck-devel] Bug#647622: logcheck: error in "logtail -t"/LOGTAILOPTS=" -t"
Package: logcheck Version: 1.3.14 Severity: normal Tags: patch Dear Maintainer, I'm not sure when this broke, but I can no longer run: sudo -u logcheck logcheck -ot as it fails with the error: Error: Could not run logtail or save output. I played around with it for a while, and ended up being able to fix it by making this modification: CHANGE: LOGTAIL_OPTS=' -t' TO: LOGTAIL_OPTS='-t' I can't make up a reason why this is needed, running the command manually works fine: sudo -u logcheck logtail2 -f/var/log/syslog -o/var/.../... -t If I run logcheck -otd, without my fix, I get: D: [1320423425] logoutput called with file: /var/log/syslog D: [1320423425] Running /usr/sbin/logtail2 on /var/log/syslog D: [1320423425] error: Killing lockfile-touch - 27393 D: [1320423425] error: Removing lockfile: /var/lock/logcheck/logcheck.lock D: [1320423425] Error: Could not run logtail or save output Error: Could not run logtail or save output. D: [1320423425] cleanup: Removing - /tmp/logcheck.BNBLQm If I add the following to logoutput() echo $LOGTAIL -f "$file" -o "$offsetfile" $LOGTAIL_OPTS $LOGTAIL -f "$file" -o "$offsetfile" $LOGTAIL_OPTS I get: D: [1320423498] logoutput called with file: /var/log/syslog D: [1320423498] Running /usr/sbin/logtail2 on /var/log/syslog /usr/sbin/logtail2 -f /var/log/syslog -o /var/lib/logcheck/offset.var.log.syslog -t File -t cannot be read: No such file or directory The logtail manual implies that -t should be before -f, but I moved LOGTAIL_OPTS to before, and it didn't change anything. I recently read some security reports about su/sudo and some changes and perhaps that is the reason? Anyway, removing the space from LOGTAIL_OPTS fixes it, and my change seems safe to make for everyone. Thanks. -- System Information: Debian Release: wheezy/sid APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Kernel: Linux 3.0.0-1-686-pae (SMP w/2 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages logcheck depends on: ii adduser 3.113 ii cron 3.0pl1-120 ii lockfile-progs 0.1.16 ii logtail 1.3.14 ii mime-construct 1.11 ii postfix [mail-transport-agent] 2.8.3-1 ii sysklogd [system-log-daemon] 1.5-6.1 Versions of packages logcheck recommends: ii logcheck-database 1.3.14 Versions of packages logcheck suggests: ii syslog-summary 1.14-2 -- Configuration Files: /etc/logcheck/logcheck.conf changed: INTRO=0 REPORTLEVEL="paranoid" SENDMAILTO="logcheck" MAILASATTACH=0 FQDN=1 TMP="/tmp" /etc/logcheck/logcheck.logfiles changed: /var/log/syslog /var/log/auth.log /var/log/mail.log /var/log/dovecot.log /var/log/rt.log /var/log/cron.log /var/log/mrtg.log -- debconf information: logcheck/changes: * logcheck/install-note:
Craig Small
2011-Nov-16 04:42 UTC
[Logcheck-devel] Bug#647622: logcheck: error in "logtail -t"/LOGTAILOPTS=" -t"
Package: logcheck Version: 1.3.14 Followup-For: Bug #647622 I've got the exact same problem with the exact same fix (thanks Jon) I was wondering why I was getting wierd emails from Logcheck failing from cron. The emails had the subject: Logcheck <host> <date> exiting due to errors -- System Information: Debian Release: wheezy/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 3.1.0-1-amd64 (SMP w/2 CPU cores) Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages logcheck depends on: ii adduser 3.113 ii cron 3.0pl1-120 ii lockfile-progs 0.1.16 ii logtail 1.3.14 ii mime-construct 1.11 ii postfix [mail-transport-agent] 2.8.5-1 ii rsyslog [system-log-daemon] 5.8.6-1 Versions of packages logcheck recommends: ii logcheck-database 1.3.14 Versions of packages logcheck suggests: pn syslog-summary <none> -- Configuration Files: /etc/logcheck/logcheck.conf [Errno 13] Permission denied: u'/etc/logcheck/logcheck.conf' /etc/logcheck/logcheck.logfiles [Errno 13] Permission denied: u'/etc/logcheck/logcheck.logfiles' -- no debconf information -- debsums errors found: debsums: changed file /usr/sbin/logcheck (from logcheck package)
Debian Bug Tracking System
2012-Jun-30 16:39 UTC
[Logcheck-devel] Bug#647622: marked as done (logcheck: error in "logtail -t"/LOGTAILOPTS=" -t")
Your message dated Sat, 30 Jun 2012 16:38:37 +0000 with message-id <E1Sl0gv-0000Sj-K0 at franck.debian.org> and subject line Bug#647622: fixed in logcheck 1.3.15 has caused the Debian Bug report #647622, regarding logcheck: error in "logtail -t"/LOGTAILOPTS=" -t" to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner at bugs.debian.org immediately.) -- 647622: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=647622 Debian Bug Tracking System Contact owner at bugs.debian.org with problems -------------- next part -------------- An embedded message was scrubbed... From: Jon Daley <debian at jon.limedaley.com> Subject: logcheck: error in "logtail -t"/LOGTAILOPTS=" -t" Date: Fri, 04 Nov 2011 12:20:07 -0400 Size: 4485 URL: <http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20120630/3a25784e/attachment.mht> -------------- next part -------------- An embedded message was scrubbed... From: Hannes von Haugwitz <hannes at vonhaugwitz.com> Subject: Bug#647622: fixed in logcheck 1.3.15 Date: Sat, 30 Jun 2012 16:38:37 +0000 Size: 7163 URL: <http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20120630/3a25784e/attachment-0001.mht>