[Logcheck-devel] Bug#647622: logcheck: error in "logtail -t"/LOGTAILOPTS=" -t"

[Jon Daley]

Package: logcheck
Version: 1.3.14
Severity: normal
Tags: patch

Dear Maintainer,
I'm not sure when this broke, but I can no longer run:
  sudo -u logcheck logcheck -ot
as it fails with the error:
  Error: Could not run logtail or save output.

I played around with it for a while, and ended up being able to fix it
by making this modification:
CHANGE:
  LOGTAIL_OPTS=' -t'
TO:
  LOGTAIL_OPTS='-t'

I can't make up a reason why this is needed, running the command manually works fine:
  sudo -u logcheck logtail2  -f/var/log/syslog -o/var/.../...  -t

If I run logcheck -otd, without my fix, I get:
D: [1320423425] logoutput called with file: /var/log/syslog
D: [1320423425] Running /usr/sbin/logtail2 on /var/log/syslog
D: [1320423425] error: Killing lockfile-touch - 27393
D: [1320423425] error: Removing lockfile: /var/lock/logcheck/logcheck.lock
D: [1320423425] Error: Could not run logtail or save output
Error: Could not run logtail or save output.
D: [1320423425] cleanup: Removing - /tmp/logcheck.BNBLQm

If I add the following to logoutput()
  echo $LOGTAIL -f "$file" -o "$offsetfile" $LOGTAIL_OPTS
  $LOGTAIL -f "$file" -o "$offsetfile" $LOGTAIL_OPTS
I get:
D: [1320423498] logoutput called with file: /var/log/syslog
D: [1320423498] Running /usr/sbin/logtail2 on /var/log/syslog
/usr/sbin/logtail2 -f /var/log/syslog -o /var/lib/logcheck/offset.var.log.syslog  -t
File  -t cannot be read: No such file or directory

The logtail manual implies that -t should be before -f, but I moved LOGTAIL_OPTS to
before, and it didn't change anything.

I recently read some security reports about su/sudo and some changes and perhaps that is the reason?
Anyway, removing the space from LOGTAIL_OPTS fixes it, and my change seems safe to make for everyone.

Thanks.

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)

Kernel: Linux 3.0.0-1-686-pae (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages logcheck depends on:
ii  adduser                         3.113     
ii  cron                            3.0pl1-120
ii  lockfile-progs                  0.1.16    
ii  logtail                         1.3.14    
ii  mime-construct                  1.11      
ii  postfix [mail-transport-agent]  2.8.3-1   
ii  sysklogd [system-log-daemon]    1.5-6.1   

Versions of packages logcheck recommends:
ii  logcheck-database  1.3.14

Versions of packages logcheck suggests:
ii  syslog-summary  1.14-2

-- Configuration Files:
/etc/logcheck/logcheck.conf changed:
INTRO=0
REPORTLEVEL="paranoid"
SENDMAILTO="logcheck"
MAILASATTACH=0
FQDN=1
TMP="/tmp"

/etc/logcheck/logcheck.logfiles changed:
/var/log/syslog
/var/log/auth.log
/var/log/mail.log
/var/log/dovecot.log
/var/log/rt.log
/var/log/cron.log
/var/log/mrtg.log


-- debconf information:
  logcheck/changes:
* logcheck/install-note: