1

I use logcheck to monitor log files, but instead of receiving reports by email I want to send them outside with bash script.

So I've used -o:

sudo -u logcheck /usr/sbin/logcheck -o 2>&1 | myscript with curl

but i receive the following error:

Error: Could not run logtail or save output.

After some test, I've seen that logcheck user doesn't have permission to read log files also if it is part of adm group.

Of course, logcheck can't be run as root user or by user with root privileges.

Someone use this package and can help me?

Centos 7 with logcheck by epel.

1

To use logcheck without root permissions, you need to ensure that the logcheck user is in the adm group (as you already discovered).

Additionally, on Centos and probably other Redhat-based distributions, you need to ensure that the logfiles are owned by group adm, i.e. execute chgrp adm on those logfiles, and make the logfiles readable by the group (chmod g+r). After doing this once, logrotate should recreate the logfiles with the same owner/group/permissions as the rotated files, as hence preserve your changes. If this is not the case, ensure that the create option in /etc/logrotate.conf and /etc/logrotate.d/* does not have any additional parameters which would override the original values.

| improve this answer | |
0

Additionally to the answer posted by @wurtel, logcheck needs to write the .offset files. We need to create them, and make them read-/writeable with for the logcheck user only:

touch /var/log/messages.offset
chmod 600 /var/log/messages.offset
chown logcheck /var/log/messages.offset

touch /var/log/secure.offset
chmod 600 /var/log/secure.offset
chown logcheck /var/log/secure.offset
| improve this answer | |
0

Actually we need not change the ownership of any files under /var/log.

I faced the same issue:

sudo -u logcheck logcheck -o -t
Error: Could not run logtail or save output.

I tried providing logcheck user permission to files under /var/log using the access list and it worked for me.

# setfacl -R -m u:logcheck:rwx /var/log/secure*
# setfacl -R -m u:logcheck:rwx /var/log/messages*
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.