[PVE-User] Upgrade to PVE8, logcheck, error on journalctl...

[Alwin Antreich]

On August 12, 2024 5:52:09 PM GMT+02:00, Marco Gaiarin <gaio at lilliput.linux.it> wrote:
>
>I extensively use 'logcheck' on my servers.
>
>I've just upgrade a server to PVE8 (a little test standalone server) and
>logcheck start complain:
>
> Logcheck failed: Your log entries may not have been checked.
> 
> Details:
> Could not run journalctl or save output
> 
> To identify the cause you may wish to:
> - Check temporary directory: /tmp/logcheck.N0YsPV
> 
> - verify that the logcheck user can read all
> logfiles specified in;
>   /etc/logcheck/logcheck.logfiles
>   /etc/logcheck/logcheck.logfiled.d/*.logfiles
>
>i've tried:
>
> root at lisei:/etc/logcheck# su -s /bin/bash - logcheck
> logcheck at lisei:~$ journalctl 
> No journal files were opened due to insufficient permissions.
>
>but:
>
> root at lisei:/etc/logcheck# id logcheck
> uid=112(logcheck) gid=118(logcheck) groups=118(logcheck),4(adm)
>
>so logcheck user seems have correct permission

Did you already look at apparmor, might it be blocked by it? You should see that in the dmesg.

Cheers,
Alwin

Hi Marco,