logcheck errors after logrotate runs
Hello :)
After upgrading recently from Woody to Sarge (which went fairly well) I now
have trouble with logcheck. I have been unable to track down a solution, or
determine for myself how logcheck deals with logfiles moved by logrotate.
Logcheck runs perfectly through the week until Sunday when logrotate does it's
thing. I immediately start getting warning emails from logcheck that logfiles
are not checked.
** example logcheck email content **
Details:
Could not run logtail or save output
Check temporary directory: /tmp/logcheck.PXhGDB
declare -x HOME="/var/lib/logcheck"
declare -x LANG="C"
declare -x LOGNAME="logcheck"
declare -x MAILTO="root"
declare -x OLDPWD
declare -x PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
declare -x PWD="/var/lib/logcheck"
declare -x SHELL="/bin/sh"
declare -x SHLVL="2"
** end **
I thought it may be a bug, but after searching high and low and not finding
anyone else with the same problem, stopped thinking that.
tmp permissions are ok: drwxrwxrwt 4 root root 16384 Mar 20 23:05 tmp
It seems as stated it can't run logtail successfully after logs are rotated.
To date the only way I have found to get logcheck running again is to take a
heavy handed approach and delete all the offset files in /var/lib/logcheck
This obviously only works for a week.
Any thoughts or suggestions on this one would be appreciated.
If anyone can point me to some in depth doco's on logcheck, that would be
useful too.
Kind Regards
--
o---------------- Dathi E Oxencroft ----- Australia ----------------:)
MCSA, MCP, CompTIA A+ Network+
If one learns from others but does not think, one will be bewildered
If one thinks but does not learn from others, one will be in peril
-Confucius
o--------- PGP key - http://www.appello.net/0x812A4FBB.txt ---------.)
Reply to: