[Logcheck-devel] Bug#515156: logcheck: fails to run after upgrade from etch to lenny

[Rainer Zocholl]

Package: logcheck
Version: 1.2.69

Hello

since updating to lenny i got every hour this waring.
Starting logcheck from shell via 
#su - logcheck -c "/usr/sbin/logcheck" logchec
works flawlessly

Maybe the script is started twice?


in "/usr/sbin/logcheck" i have added "$UID" to see in which contest cron
ran the script.
That seems to be OK.

:/etc# ls -al /etc/cron.d/logcheck
-rw-r--r-- 1 root root 347 Jul 15  2005 /etc/cron.d/logcheck
# /etc/cron.d/logcheck: crontab entries for the logcheck package

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root

@reboot         logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10
/usr/sbin/logcheck -R; fi
2 * * * *       logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10
//usr/sbin/logcheck; fi

:/etc# ll /etc/cron.hourly/
total 0



:/etc# ls -al /var/lock/logcheck/logcheck.lock
ls: cannot access /var/lock/logcheck/logcheck.lock: No such file or
directory

:/etc# ls -al /var/lock/logcheck/
total 8
drwxr-xr-x  2 logcheck logcheck 4096 Mar  3 14:02 .
drwxrwxrwt 11 root     root     4096 Mar  3 06:42 ..

:/etc# ls -al /etc/logcheck/
total 1160
drwxr-xr-x   9 root logcheck    4096 Mar  3 12:55 .
drwxr-xr-x 171 root root        8192 Mar  3 13:47 ..
-rwxr-s---   2 root logcheck    4096 Feb 25 14:42 cracking.d
drwxr-s---   2 root logcheck    4096 Apr 19  2005 cracking.ignore.d
-rw-r--r--   1 root logcheck     180 Apr 19  2004 header.txt
drwxr-s---   2 root logcheck    4096 Feb 27 12:52 ignore.d.paranoid
drwxr-s---   2 root logcheck    8192 Feb 27 12:52 ignore.d.server
drwxr-s---   2 root logcheck    4096 Feb 27 12:52 ignore.d.workstation
-rw-r-----   1 root logcheck    2582 Feb 11 12:57 logcheck.conf
-rw-r-----   1 root logcheck    1941 Jul 15  2005 logcheck.conf.dpkg-old
-rw-r-----   1 root logcheck     210 Mar  3 12:54 logcheck.logfiles
drwxr-s---   2 root logcheck    4096 Feb 25 14:42 violations.d
drwxr-s---   2 root logcheck    4096 Feb 25 14:42 violations.ignore.d


/etc# id logcheck
uid=109(logcheck) gid=109(logcheck) groups=109(logcheck),4(adm)






Warning: If you are seeing this message, your log files may not have been
checked! UID(109)

Details:
Failed to get lockfile: /var/lock/logcheck/logcheck.lock


Also verify that the logcheck user can read all files referenced in
/etc/logcheck/logcheck.logfiles!

declare -x HOME="/var/lib/logcheck"
declare -x LOGNAME="logcheck"
declare -x MAILTO="root"
declare -x OLDPWD
declare -x
PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
declare -x PWD="/var/lib/logcheck"
declare -x SHELL="/bin/sh"
declare -x SHLVL="2"