Problem with logcheck

[byrnejb]

FreeBSD-14.2p2

su -m logcheck -c "/usr/local/bin/bash /usr/local/sbin/logcheck -v"
logcheck unknown

When I run logcheck I get this error:

# sudo -u logcheck logcheck
Error: Could not run logtail or save output

When I run logtail I get this error:

# sudo -u logcheck logtail
No logfile to read. Use -f [LOGFILE].

# cat /usr/local/etc/logcheck/logcheck.logfiles.d/syslog.logfiles
## Log entries in the logs listed below will be checked by logcheck

# The default is to check standard syslog files
# created by rsyslog or other syslog daemons

# (If your system does not use a syslog daemon you
# can comment these lines out)
/var/log/auth.log
/var/log/messages

[root@vhost01 ~ (master)]# ll /var/log/auth.log
-rw-------  1 root wheel 89236 Jun  2 10:03 /var/log/auth.log
[root@vhost01 ~ (master)]# ll /var/log/messages
-rw-r--r--  1 root wheel 738936 May 30 14:46 /var/log/messages

I have other systems which appear to me to be identically configured and which are not displaying this error.

any help gratefully accepted

 

[rafael_grether]

It seems, logcheck originally is a debian package, and the FreeBSD Porter created numerous patches to run.

First of all, logcheck -v uses "dpkg-parsechangelog -S version" to put version.
VERSION=$$(dpkg-parsechangelog -S version)
And FreeBSD dont recognize dpkg-parsechangelog, a specific debian tool.

About second error (Error: Could not run logtail or save output), it seems the user logcheck don't have permission to see log files, like auth.log, so there is no output to save.