Logcheck devel - Sep 2007 - Bug#443987: logcheck: Exiting due to errors

Package: logcheck
Version: 1.2.61
Severity: important


Logcheck sends mails:
Warning: If you are seeing this message, your log files may not have been
checked!

Details:
Could not run logtail or save output

Check temporary directory: /tmp/logcheck.Lz3123

Also verify that the logcheck user can read all files referenced in
/etc/logcheck/logcheck.logfiles!

declare -x HOME="/var/lib/logcheck"
declare -x LOGNAME="logcheck"
declare -x MAILTO="root"
declare -x OLDPWD
declare -x
PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
declare -x PWD="/var/lib/logcheck"
declare -x SHELL="/bin/sh"
declare -x SHLVL="2"


In the logcheck.logfiles I have standard files:
# these files will be checked by logcheck
# This has been tuned towards a default syslog install
/var/log/syslog
/var/log/auth.log


Regards
Wojciech Zareba

-- System Information:
Debian Release: lenny/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)

Kernel: Linux 2.6.21-2-686 (SMP w/1 CPU core)
Locale: LANG=pl_PL.UTF-8, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages logcheck depends on:
ii  adduser          3.105                   add and remove users and groups
ii  cron             3.0pl1-100              management of regular background p
ii  lockfile-progs   0.1.11                  Programs for locking and unlocking
ii  logtail          1.2.61                  Print log file lines that have not
ii  mailx            1:8.1.2-0.20070424cvs-1 A simple mail user agent
ii  postfix [mail-tr 2.4.5-4                 High-performance mail transport ag
ii  sysklogd [system 1.5-1                   System Logging Daemon

Versions of packages logcheck recommends:
ii  logcheck-database             1.2.61     database of system log rules for t

-- no debconf information

On Tue, Sep 25, 2007 at 12:32:44PM +0200, Wojciech Zareba
wrote:
> Package: logcheck
> Version: 1.2.61
> Severity: important
> 
> Logcheck sends mails:
> Warning: If you are seeing this message, your log files may not have been
> checked!
I think this is due to an unversioned dependency on logtail, fixed in
logcheck 1.2.62 from today's unstable.  Can you retry with that
version?

Otherwise, what version logtail do you have?

dpkg -l logtail\*

Can you check if the logcheck user is in the adm group and that the
logfiles have that groupship and read permission?

id logcheck 
ls -l /var/log/{syslog,auth.log}
> Details:
> Could not run logtail or save output
Can you also check that none of your partitions are full?

df |grep -we tmp
df |sort -nrk5 |sed 1q
> Check temporary directory: /tmp/logcheck.Lz3123
What's in that directory?

----- Original Message -----
From: Justin Pryzby <jpryzby+d at quoininc.com>
Date: Tuesday, September 25, 2007 4:53 pm
Subject: Re: Bug#443987: logcheck: Exiting due to errors
> BTW did this only happen after upgrading did you just install the
> package for the first time??
> 
After upgrade. Version 1.2.60 seems to be fine. I will investigate it
tomorrow.

Wojciech