Posting a reply to this old thread because I have run into this and solved it only to forget it and need to solve it again.
Where I then happen upon this thread for the umpteen time.
So posting the solution for my self and everyone else.
Verify that logcheck has both a user and group in /etc/passwd and /etc/group.
Ensure that logcheck is a member of group adm. <--- <--- <---
Ensure that the logs are readable by adm so that logcheck can read the logs otherwise your:
Code:
su -s /bin/sh -c '/usr/sbin/logcheck -dt' - logcheck
output or email errors will complain about permission denied errors accessing the log files.
Code:
find /var/log/ -type f -exec chgrp adm {} ';'
or
Code:
find /var/log/ -type f -exec chown root:adm {} ';'
Code:
find /var/log/ -type f -exec chmod g+r {} ';'
find /var/log/ -type f -exec chmod o-rwx {} ';'
or
Code:
find /var/log/ -type f -exec chmod 640 {} ';'
Code:
find /var/log/ -type d -exec chmod 755 {} ';'
It's also good to ensure you have a logcheck alias in /etc/aliases pointing at your primary account so the logcheck user is not filling up the mail spool with mail you never check. Of course run newaliases or postmap as the case may be.
Also on selinux enabled systems run restorecon -Rv /etc/logcheck after updating or adding new local-* rules.
