Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
thanks for your further feadback. On Wed, 08 Jun 2005, Grahame White wrote: On Wednesday 08 June 2005 13:11, maximilian attems wrote: On Wed, 08 Jun 2005, Grahame white wrote: Since upgrading from woody to sarge I've been getting the following apperaring in the reports sent by logcheck: E: File could not be read: /var/log/mail/mail.err E: File could not be read: /var/log/mail/mail.warn E: File could not be read: /var/log/mail/mail.info E: File could not be read: /var/log/mail/mail.log rereading your bug report. i forgot to ask about the permissions of the /var/log/mail/ dir. please send the ouput of ls -ld /var/log/mail/ any other progress? -- maks -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
On Tuesday 19 July 2005 12:07, maximilian attems wrote: thanks for your further feadback. On Wed, 08 Jun 2005, Grahame White wrote: On Wednesday 08 June 2005 13:11, maximilian attems wrote: On Wed, 08 Jun 2005, Grahame white wrote: Since upgrading from woody to sarge I've been getting the following apperaring in the reports sent by logcheck: E: File could not be read: /var/log/mail/mail.err E: File could not be read: /var/log/mail/mail.warn E: File could not be read: /var/log/mail/mail.info E: File could not be read: /var/log/mail/mail.log rereading your bug report. i forgot to ask about the permissions of the /var/log/mail/ dir. please send the ouput of ls -ld /var/log/mail/ drwxrws--- 2 root smmsp 1024 Jul 19 06:30 /var/log/mail/ Grahame -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
On Tue, 19 Jul 2005, Grahame White wrote: On Tuesday 19 July 2005 12:07, maximilian attems wrote: snipp On Wed, 08 Jun 2005, Grahame white wrote: Since upgrading from woody to sarge I've been getting the following apperaring in the reports sent by logcheck: E: File could not be read: /var/log/mail/mail.err E: File could not be read: /var/log/mail/mail.warn E: File could not be read: /var/log/mail/mail.info E: File could not be read: /var/log/mail/mail.log rereading your bug report. i forgot to ask about the permissions of the /var/log/mail/ dir. please send the ouput of ls -ld /var/log/mail/ drwxrws--- 2 root smmsp 1024 Jul 19 06:30 /var/log/mail/ aah cool, no way logcheck could read inside of that dir. sorry for my sendmail ignorance, but is that the default permission, or did you harden it somehow? is that an sarge installation or woody upgrade? which are the member of aboves group: getent group smmsp either you change aboves dir to be readable for the adm group chgrp adm /var/log/mail/ (shouldn't pose problems to sendmail as it doesn't write aboves file with smmsp group permissions). or you add logcheck to aboves group: adduser --quiet logcheck smmsp -- maks -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
On Tuesday 19 July 2005 13:06, you wrote: On Tue, 19 Jul 2005, Grahame White wrote: On Tuesday 19 July 2005 12:07, maximilian attems wrote: snipp On Wed, 08 Jun 2005, Grahame white wrote: Since upgrading from woody to sarge I've been getting the following apperaring in the reports sent by logcheck: E: File could not be read: /var/log/mail/mail.err E: File could not be read: /var/log/mail/mail.warn E: File could not be read: /var/log/mail/mail.info E: File could not be read: /var/log/mail/mail.log rereading your bug report. i forgot to ask about the permissions of the /var/log/mail/ dir. please send the ouput of ls -ld /var/log/mail/ drwxrws--- 2 root smmsp 1024 Jul 19 06:30 /var/log/mail/ aah cool, no way logcheck could read inside of that dir. sorry for my sendmail ignorance, but is that the default permission, or did you harden it somehow? is that an sarge installation or woody upgrade? It was a standard woody install that I upgraded to sarge. I haven't touched the permissions on this directory myself so I assume that whatever program created it set them like that. which are the member of aboves group: getent group smmsp No one is in the group. either you change aboves dir to be readable for the adm group chgrp adm /var/log/mail/ (shouldn't pose problems to sendmail as it doesn't write aboves file with smmsp group permissions). Certainly shouldn't! I just double-checked, I don't even have sendmail installed :) or you add logcheck to aboves group: adduser --quiet logcheck smmsp -- maks -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
On Tuesday 19 July 2005 13:58, maximilian attems wrote: On Tue, 19 Jul 2005, Grahame White wrote: On Tuesday 19 July 2005 13:06, you wrote: On Tue, 19 Jul 2005, Grahame White wrote: snipp drwxrws--- 2 root smmsp 1024 Jul 19 06:30 /var/log/mail/ aah cool, no way logcheck could read inside of that dir. sorry for my sendmail ignorance, but is that the default permission, or did you harden it somehow? is that an sarge installation or woody upgrade? It was a standard woody install that I upgraded to sarge. I haven't touched the permissions on this directory myself so I assume that whatever program created it set them like that. which are the member of aboves group: getent group smmsp No one is in the group. either you change aboves dir to be readable for the adm group chgrp adm /var/log/mail/ (shouldn't pose problems to sendmail as it doesn't write aboves file with smmsp group permissions). Certainly shouldn't! I just double-checked, I don't even have sendmail installed :) ok strange. an smmsp google gave lots of sendmail hits, that's why i assumed it. whats you mail transfer agent? (exim4, postfix, ..) does it work fine with aboves change? I'm using exim4, and yes the change you suggested seems to have fixed the problem. i guess so, as nobody uses that group the permission group setting of /var/log/mail seems more like an accident. now that logcheck should run without troubles, can you confirm? i guess we can close that bug. Yes, I'm fine with closing the bug -- maks -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
On Tuesday 19 July 2005 17:48, maximilian attems wrote: On Tue, 19 Jul 2005, Grahame White wrote: snipp I'm using exim4, and yes the change you suggested seems to have fixed the problem. i guess so, as nobody uses that group the permission group setting of /var/log/mail seems more like an accident. now that logcheck should run without troubles, can you confirm? i guess we can close that bug. Yes, I'm fine with closing the bug thanks for your feedback, i'm happy to hear logcheck is running fine. :) although this bug may need to be reassigned to the package, which created that strange group ownership of /var/log/mail. exim4 usually logs to /var/log/exim4 on all of standard installs i see around me. so what mail subsystem of yours is logging to aboves dir? do you have some custom syslog (or syslog-ng) rules that direct messages there? maybe we can grasp which packet added the smmsp user. what does belows command on your box show: egrep smmsp -r /var/lib/dpkg/info/ /var/lib/dpkg/info/sendmail.postrm: # Remove user/group smmsp /var/lib/dpkg/info/sendmail.postrm: deluser --quiet smmsp || true; /var/lib/dpkg/info/sendmail.postrm: userdel smmsp 2/dev/null || true; /var/lib/dpkg/info/sendmail.postrm: groupdel smmsp 2/dev/null || true; As you said earlier, it looks like a sendmail problem except that I don't have it installed. I don't recall having ever installed it previously either. Grahame -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
On Tue, 19 Jul 2005, Grahame White wrote: snipp I'm using exim4, and yes the change you suggested seems to have fixed the problem. i guess so, as nobody uses that group the permission group setting of /var/log/mail seems more like an accident. now that logcheck should run without troubles, can you confirm? i guess we can close that bug. Yes, I'm fine with closing the bug thanks for your feedback, i'm happy to hear logcheck is running fine. :) although this bug may need to be reassigned to the package, which created that strange group ownership of /var/log/mail. exim4 usually logs to /var/log/exim4 on all of standard installs i see around me. so what mail subsystem of yours is logging to aboves dir? do you have some custom syslog (or syslog-ng) rules that direct messages there? maybe we can grasp which packet added the smmsp user. what does belows command on your box show: egrep smmsp -r /var/lib/dpkg/info/ -- maks -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
On Tue, 19 Jul 2005, Grahame White wrote: On Tuesday 19 July 2005 17:48, maximilian attems wrote: snipp maybe we can grasp which packet added the smmsp user. what does belows command on your box show: egrep smmsp -r /var/lib/dpkg/info/ /var/lib/dpkg/info/sendmail.postrm: # Remove user/group smmsp /var/lib/dpkg/info/sendmail.postrm: deluser --quiet smmsp || true; /var/lib/dpkg/info/sendmail.postrm: userdel smmsp 2/dev/null || true; /var/lib/dpkg/info/sendmail.postrm: groupdel smmsp 2/dev/null || true; As you said earlier, it looks like a sendmail problem except that I don't have it installed. I don't recall having ever installed it previously either. Grahame ok. but does look like removed and not purged after install. you can check the dpkg status, what does that show: dpkg -l sendmail -- maks -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
On Tuesday 19 July 2005 18:04, maximilian attems wrote: On Tue, 19 Jul 2005, Grahame White wrote: On Tuesday 19 July 2005 17:48, maximilian attems wrote: ok. but does look like removed and not purged after install. you can check the dpkg status, what does that show: dpkg -l sendmail rc sendmail 8.12.3-6.6A powerful, efficient, and scalable Mail Transport Agent Hmm, looks like I did have it installed at some point. -- maks -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
thanks for your provided feedback. saw no direct hint in the debug info there. but i had another idea of what could go wrong. could you please send the output of belows command as root # ls -l /var/lib/logcheck -- maks -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
On Tuesday 21 June 2005 23:14, maximilian attems wrote: thanks for your provided feedback. saw no direct hint in the debug info there. but i had another idea of what could go wrong. could you please send the output of belows command as root # ls -l /var/lib/logcheck Sure. # ls -l /var/lib/logcheck/ total 14 drwx-- 4 logcheck logcheck 1024 Apr 17 2004 cleaned -rw--- 1 logcheck logcheck 13 Jun 22 06:02 offset.var.log.auth.log -rw--- 1 logcheck logcheck 13 Jun 22 06:02 offset.var.log.daemon.log -rw--- 1 logcheck logcheck 11 Jun 20 07:02 offset.var.log.debug -rw--- 1 logcheck logcheck8 Apr 24 07:02 offset.var.log.kern.log -rw--- 1 logcheck logcheck8 Jun 19 07:02 offset.var.log.lpr.log -rw--- 1 logcheck logcheck8 Feb 27 07:02 offset.var.log.mail.mail.err -rw--- 1 logcheck logcheck 14 Jun 7 18:02 offset.var.log.mail.mail.info -rw--- 1 logcheck logcheck 14 Jun 7 18:02 offset.var.log.mail.mail.log -rw--- 1 logcheck logcheck8 Feb 27 07:02 offset.var.log.mail.mail.warn -rw--- 1 logcheck logcheck 11 Jun 22 06:02 offset.var.log.messages -rw--- 1 logcheck logcheck 13 Jun 22 06:02 offset.var.log.syslog -rw--- 1 logcheck logcheck8 Sep 5 2004 offset.var.log.user.log -rw--- 1 logcheck logcheck8 Oct 16 2003 offset.var.log.uucp.log -- maks -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
On Wed, 08 Jun 2005, Grahame white wrote: Since upgrading from woody to sarge I've been getting the following apperaring in the reports sent by logcheck: E: File could not be read: /var/log/mail/mail.err E: File could not be read: /var/log/mail/mail.warn E: File could not be read: /var/log/mail/mail.info E: File could not be read: /var/log/mail/mail.log The permissions for these files are: -rw-r- 1 root adm2748 Jun 7 18:28 mail.err -rw-r- 1 root adm 1983524 Jun 8 00:07 mail.info -rw-r- 1 root adm 2268687 Jun 8 00:07 mail.log -rw-r- 1 root adm2748 Jun 7 18:28 mail.warn and the user logcheck is a member of the adm group. what version of logtail do you have installed? dpkg -l logtail could you please send us the debug output of logcheck: logcheck -d -o thanks for your feedback. -- maks -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#312412: [Logcheck-devel] Bug#312412: logcheck: Fails to read files under /var/log/mail/
On Wednesday 08 June 2005 13:11, maximilian attems wrote: On Wed, 08 Jun 2005, Grahame white wrote: Since upgrading from woody to sarge I've been getting the following apperaring in the reports sent by logcheck: E: File could not be read: /var/log/mail/mail.err E: File could not be read: /var/log/mail/mail.warn E: File could not be read: /var/log/mail/mail.info E: File could not be read: /var/log/mail/mail.log The permissions for these files are: -rw-r- 1 root adm2748 Jun 7 18:28 mail.err -rw-r- 1 root adm 1983524 Jun 8 00:07 mail.info -rw-r- 1 root adm 2268687 Jun 8 00:07 mail.log -rw-r- 1 root adm2748 Jun 7 18:28 mail.warn and the user logcheck is a member of the adm group. what version of logtail do you have installed? dpkg -l logtail 1.2.39 could you please send us the debug output of logcheck: logcheck -d -o Please find the output attached thanks for your feedback. -- maks logcheck.debug.tar.gz Description: application/tgz
Bug#312412: logcheck: Fails to read files under /var/log/mail/
Package: logcheck Severity: normal Since upgrading from woody to sarge I've been getting the following apperaring in the reports sent by logcheck: E: File could not be read: /var/log/mail/mail.err E: File could not be read: /var/log/mail/mail.warn E: File could not be read: /var/log/mail/mail.info E: File could not be read: /var/log/mail/mail.log The permissions for these files are: -rw-r- 1 root adm2748 Jun 7 18:28 mail.err -rw-r- 1 root adm 1983524 Jun 8 00:07 mail.info -rw-r- 1 root adm 2268687 Jun 8 00:07 mail.log -rw-r- 1 root adm2748 Jun 7 18:28 mail.warn and the user logcheck is a member of the adm group. -- System Information: Debian Release: 3.1 Architecture: i386 (i686) Kernel: Linux 2.4.27 Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968) -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
