Logcheck users - Mar 2005 - logcheck errors after logrotate runs

--nextPart2699335.H7BBWTdPIb
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hello :)

After upgrading recently from Woody to Sarge (which went fairly well) I now=20
have trouble with logcheck. I have been unable to track down a solution.

Logcheck runs perfectly through the week until Sunday when logrotate does
it's=20
thing. I immediately start getting warning emails from logcheck that logfiles=20
are not checked.

** example logcheck email content **

Details:
Could not run logtail or save output

Check temporary directory: /tmp/logcheck.PXhGDB

declare -x HOME=3D"/var/lib/logcheck"
declare -x LANG=3D"C"
declare -x LOGNAME=3D"logcheck"
declare -x MAILTO=3D"root"
declare -x OLDPWD
declare -x
PATH=3D"/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
declare -x PWD=3D"/var/lib/logcheck"
declare -x SHELL=3D"/bin/sh"
declare -x SHLVL=3D"2"

** end **

The stated tmp directory is different with each emailed error and I believe
/tmp permissions are ok: drwxrwxrwt    4 root root  16384 Mar 20 23:05 tmp

It seems as stated it can't run logtail successfully after logs are rotated.

To date the only way I have found to get logcheck running again is to take a=20
heavy handed approach and delete all the offset files in /var/lib/logcheck
This obviously only works for a week.

I tried asking on the debian users list but received no replies.

Any thoughts or suggestions on this one would be appreciated.=20

Kind Regards

=2D-=20
o---------------- Dathi E Oxencroft ----- Australia ----------------:)
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0=A0 MCSA, MCP, CompTIA A+ Network+
=A0If one learns from others but does not think, one will be bewildered
=A0If one thinks but does not learn from others, one will be in peril
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0-Confucius
o--------- PGP key - http://www.appello.net/0x812A4FBB.txt ---------.)

--nextPart2699335.H7BBWTdPIb
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD4DBQBCSHeWqoduTYEqT7sRAtkSAJ96HB+nd7HP7sQ7qIrl+GnNMGt2agCY5TSg
OMr+D1PjF1kgG2XriJoXvg==5sxk
-----END PGP SIGNATURE-----

--nextPart2699335.H7BBWTdPIb--

Hi Dathi,

On Tue, Mar 29, 2005 at 07:30:57AM +1000, Dathi Oxencroft
wrote:
> Hello :)
> 
> After upgrading recently from Woody to Sarge (which went fairly well) I now
> have trouble with logcheck. I have been unable to track down a solution.
> 
> Logcheck runs perfectly through the week until Sunday when logrotate does
it's
> thing. I immediately start getting warning emails from logcheck that
logfiles
> are not checked.
Could you let me know the results of these commands:
ls -l /var/lib/logcheck
ls -l /var/log/syslog
getent passwd logcheck
groups logcheck

Also, debugging output may help (logcheck -d)

This is sounding like a permissions issue, but I'm curious as to how it has
arrisen.  Do you have any special configuration for logcheck/logrotate?

Cheers,
-- 
[   Todd J. Troxell                                         ,''`.
      Student, Debian GNU/Linux Developer, SysAdmin, Geek  : :' :
      http://debian.org || http://rapidpacket.com/~xtat    `. `' 
                                                             `-     ]