[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

logcheck errors after logrotate runs

Hello :)

After upgrading recently from Woody to Sarge (which went fairly well) I now 
have trouble with logcheck. I have been unable to track down a solution, or 
determine for myself how logcheck deals with logfiles moved by logrotate.

Logcheck runs perfectly through the week until Sunday when logrotate does it's 
thing. I immediately start getting warning emails from logcheck that logfiles 
are not checked.

** example logcheck email content **

Could not run logtail or save output

Check temporary directory: /tmp/logcheck.PXhGDB

declare -x HOME="/var/lib/logcheck"
declare -x LANG="C"
declare -x LOGNAME="logcheck"
declare -x MAILTO="root"
declare -x OLDPWD
declare -x PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
declare -x PWD="/var/lib/logcheck"
declare -x SHELL="/bin/sh"
declare -x SHLVL="2"

** end **

I thought it may be a bug, but after searching high and low and not finding 
anyone else with the same problem, stopped thinking that.

tmp permissions are ok: drwxrwxrwt    4 root root  16384 Mar 20 23:05 tmp

It seems as stated it can't run logtail successfully after logs are rotated.

To date the only way I have found to get logcheck running again is to take a 
heavy handed approach and delete all the offset files in /var/lib/logcheck
This obviously only works for a week.

Any thoughts or suggestions on this one would be appreciated. 

If anyone can point me to some in depth doco's on logcheck, that would be 
useful too.

Kind Regards

o---------------- Dathi E Oxencroft ----- Australia ----------------:)
                   MCSA, MCP, CompTIA A+ Network+
 If one learns from others but does not think, one will be bewildered
 If one thinks but does not learn from others, one will be in peril
o--------- PGP key - http://www.appello.net/0x812A4FBB.txt ---------.)

Reply to: