From owner-freebsd-questions@FreeBSD.ORG  Mon Sep  8 20:45:19 2008
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id A09E8106566C
	for <questions@freebsd.org>; Mon,  8 Sep 2008 20:45:19 +0000 (UTC)
	(envelope-from mbeis@xs4all.nl)
Received: from smtp-vbr9.xs4all.nl (smtp-vbr9.xs4all.nl [194.109.24.29])
	by mx1.freebsd.org (Postfix) with ESMTP id 43B148FC19
	for <questions@freebsd.org>; Mon,  8 Sep 2008 20:45:19 +0000 (UTC)
	(envelope-from mbeis@xs4all.nl)
Received: from yokozuna.lan (213-84-73-82.adsl.xs4all.nl [80.101.78.208])
	by smtp-vbr9.xs4all.nl (8.13.8/8.13.8) with ESMTP id m88KTLLI051639
	for <questions@freebsd.org>; Mon, 8 Sep 2008 22:29:22 +0200 (CEST)
	(envelope-from mbeis@xs4all.nl)
Received: from yokozuna.lan (yokozuna.lan [127.0.0.1])
	by yokozuna.lan (8.14.2/8.14.2) with ESMTP id m88KTLIJ051979
	for <questions@freebsd.org>; Mon, 8 Sep 2008 22:29:21 +0200 (CEST)
	(envelope-from mbeis@xs4all.nl)
Date: Mon, 8 Sep 2008 22:29:21 +0200
From: Marco Beishuizen <mbeis@xs4all.nl>
To: FreeBSD-Questions <questions@freebsd.org>
Message-ID: <20080908222921.4daba36a@yokozuna.lan>
X-Mailer: Claws Mail 3.5.0 (GTK+ 2.12.11; i386-portbld-freebsd7.0)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by XS4ALL Virus Scanner
Cc: 
Subject: logcheck doesn't work anymore
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Sep 2008 20:45:19 -0000

Hi,

After upgrading logcheck from 1.1.1 to 1.2.54 I suddenly get errors of
logcheck not working correctly:

...
Warning: If you are seeing this message, your log files may not have
been checked!

Details:
Could not run logtail or save output

Check temporary directory: /tmp/logcheck.6IZZmq

Also verify that the logcheck user can read all files referenced in
/etc/logcheck/logcheck.logfiles!

declare -x HOME="/var/lib/logcheck"
declare -x LOGNAME="logcheck"
declare -x MAILTO="root"
declare -x OLDPWD
declare -x
PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin"
declare -x PWD="/var/lib/logcheck" declare -x SHELL="/bin/sh"
declare -x SHLVL="1"
declare -x USER="logcheck"
...

In version 1.1.1 there was a script logcheck.sh in cron that ran every
hour but that doesn't seem to exist anymore. Trying to run logcheck
manually results in:

...
logcheck should not be run as root. Use su to invoke logcheck:
su logcheck -c "/usr/local/bin/bash /usr/local/sbin/logcheck"
Or use sudo: sudo -u logcheck logcheck.
...

But this doesn't seem to do anything.

How can I use logcheck again?

Thanks,

Marco

-- 
If I want your opinion, I'll ask you to fill out the necessary form.