Note that fixing this bug is a necessary, but not a sufficient condition to make logcheck work on gutsy.
After fixing this manually, I still get one more failure later from logtail:
File /var/log/syslog.offset cannot be created. Check your permissions: Permission denied
To solve this problem too, I had to manually create the offset files and make them owned by logcheck:
sudo touch /var/log/syslog.offset /var/log/auth.log.offset
sudo chown logcheck /var/log/syslog.offset /var/log/auth.log.offset
In addition, logtail when running as 'logcheck' cannot read files under /var/log which aren't world readable,
Fixing this required giving logtail a setgid and group adm:
Note that fixing this bug is a necessary, but not a sufficient condition to make logcheck work on gutsy.
After fixing this manually, I still get one more failure later from logtail: syslog. offset cannot be created. Check your permissions: Permission denied
File /var/log/
To solve this problem too, I had to manually create the offset files and make them owned by logcheck: syslog. offset /var/log/ auth.log. offset syslog. offset /var/log/ auth.log. offset
sudo touch /var/log/
sudo chown logcheck /var/log/
In addition, logtail when running as 'logcheck' cannot read files under /var/log which aren't world readable,
Fixing this required giving logtail a setgid and group adm:
sudo chgrp adm /usr/sbin/logtail
sudo chmod g+s /usr/sbin/logtail
only after fixing all the above logcheck finally works for me on gutsy.