This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Package: logcheck
Version: 1.4.4
Severity: important

Since todays update of logcheck I get every message twice, and the
first entry is:
2025-05-14T19:02:04.733378+02:00 twentytwo exim[42129]: 2025-05-14 19:02:04 1uFFUa-00000000AxR-2z0z failed to write to main log: length=98 result=-1 errno=9 (Bad file descriptor)
2025-05-14T19:02:04.735285+02:00 twentytwo exim[42129]: write failed on panic log: length=123 result=-1 errno=9 (Bad file descriptor)

Since exim (also in conjunction with previous logcheck) works fine and
logcheck was just updated before the error appeared, I'm quite confident
this is a logcheck problem.

However, I have no idea where to look for this problem, but I can most certainly provide more information, please tell me what you need.

(I chose severity: Important, as right now logcheck seems still to
work, however, I don't think with this message and 2 mails logcheck is
in a releasable state).


-- System Information:
Debian Release: trixie/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to de_DE.UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages logcheck depends on:
ii adduser 3.150
ii anacron 2.3-42
ii cron [cron-daemon] 3.0pl1-196
ii exim4-daemon-light [mail-transport-agent] 4.98.2-1
ii lockfile-progs 0.2.0
ii logtail 1.4.4
ii mime-construct 1.12+really1.11-1
ii systemd-sysv 257.5-2

Versions of packages logcheck recommends:
ii logcheck-database 1.4.4

Versions of packages logcheck suggests:
ii rsyslog [system-log-daemon] 8.2502.0-6

-- Configuration Files:
/etc/logcheck/header.txt [Errno 13] Keine Berechtigung: '/etc/logcheck/header.txt'
/etc/logcheck/logcheck.conf [Errno 13] Keine Berechtigung: '/etc/logcheck/logcheck.conf'
/etc/logcheck/logcheck.logfiles [Errno 13] Keine Berechtigung: '/etc/logcheck/logcheck.logfiles'
/etc/logcheck/logcheck.logfiles.d/journal.logfiles [Errno 13] Keine Berechtigung: '/etc/logcheck/logcheck.logfiles.d/journal.logfiles'
/etc/logcheck/logcheck.logfiles.d/syslog.logfiles [Errno 13] Keine Berechtigung: '/etc/logcheck/logcheck.logfiles.d/syslog.logfiles'

-- no debconf information

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgk8AMACgkQQbqlJmgq 5nAMSBAAiIE1sN/P4D1vuix1A45EUJd1rkzlxgPBI1CEonWln051VSX1ArD/R8to Dt5AUog+rb9h+fcAqzghcFeW4JLV2X9NohmcZGXoBR/PtRQBMvG5dyGuB1Hx7T5d 0WoLIOCGNsBmNVSzooxmqNEKGn0Z8Ygq8GMd0eqFhjc8XeudwyuVj+85yw1bvx2j 5QXbzkZu5HA9k93QTr50EaBiS21yzRutA1cUf+FkHHUs5XtUTsdYqa8mPBR4ozGw 2iwlEcIlHshK5UlhAAMOENn1svuh/OUgWuCCnNsXamtZCqfNOavxRR+TOdHFgO4c /15jprbRkibfj/hkmz92+SypqsOzD8032KjkXeIU95lbnrw8/ZI2nNm7YCn9oLGS f8wL7omvPAN6gzKPSENXJBkQwWg5Yiwz9FAl7puk4jhu5qGtnA32qnuQm1mKd1eb 5TzBMLbUkNN/mVoWHVLdvxM0lPcN6FfT7jKEnvSC3p+0rH1dZzX0iDZSGOr0PGru YXlzbRtLAs1ZnYFrB5euBjuf/BkagTtvpVp02O+KUpjLVi40pgbM/IjX949NMFVV PKi23AjMEvm+S/TLxVkyl9RDFISn55EulCLnz3i

On Wed, 14 May 2025 at 20:36, Helge Kreutzmann <debian@helgefjell.de> wrote:

Since todays update of logcheck I get every message twice,

does message mean every email, email from logcheck, or line in the
logceck report?

is this perhaps because logcheck is reporting messages that are in the
journal and rsyslog? (it should!)

and the
first entry is:
2025-05-14T19:02:04.733378+02:00 twentytwo exim[42129]: 2025-05-14 19:02:04 1uFFUa-00000000AxR-2z0z failed to write to main log: length=98 result=-1 errno=9 (Bad file descriptor)
2025-05-14T19:02:04.735285+02:00 twentytwo exim[42129]: write failed on panic log: length=123 result=-1 errno=9 (Bad file descriptor)

Since exim (also in conjunction with previous logcheck) works fine

this is exim saying that it was unable to write to
/var/log/exim4/paniclog and failing - this very much suggests exim is
not working fine
if you are getting an emial from logcheck then that suggests logcheck
is doing it's job and showing an issue.

However, I have no idea where to look for this problem, but I can most certainly provide more information, please tell me what you need.

obvious things would be

is logcheck running from the systemd timer or the cron script?
what exim configuration are you using?
is the disk (or /var/log partition) full?
what are the permissions on /var/log/exim4/ and
/var/log/exim4/paniclog? (ls -l ?)
is anything in paniclog?
do other email messages work?
what lines are in the journal when logcheck runs?
what happens if you run logcheck manually? with the -d option?
what is in logcheck.conf?

(do check if anything is sensitive before posting to the bug - dont
think there should be)

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Indeed, that looks unusual. I did find one old report on the debian-
user list that's similar, but was ultimately unsolved[0].

If you're getting two duplicate emails, that indicates logcheck is
running from both the crontab and new systemd timer. In that case, can
you share the contents of /etc/cron.d/logcheck? If you had locally
modified that file, it might not have been properly updated to not run
in a systemd environment.

Richard provided several good things to check that will help track
down the root cause of this issue.

Mathias

[0] -- https://lists.debian.org/debian-user/2023/06/msg00163.html

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE1Bp60H32xfynSJ8cKe7i1uz0QvkFAmglZOYACgkQKe7i1uz0 QvmOZQ/+N9+2TSCVDKn/IIr4La52P5QjB1i68xahiRI8a1flVyvLSC7l1oJjiBpS Q6dtgPPwQMADfNQtShb7ZduUdBbx6Fw6nbDUujlLwSwk2IJqWMKg6qnbsqJ8uwOT 7fmqolXLVwelhtsDoTsCGLams5LaXS9rHuxxONG9EscO74OQfJqMCO7hLLO4tudc jttmACIaSzDjKuACCkqm3EG+zjCqCPIkkOLz39VrIWP4d1DIX0jMagxLhh1Tr0zr PK+so7XGz6TdNb0WTJ5sOFHPOs4o0gtHDfV8qW5aeuKgkwpcys8ut0ZAvLBeeoKl Z9RQsuWQwN3oE7zQtEdhy8v07b7Ig/744V/0LUr7JZMLogcjMlCnkrHYU8xLorhB g6tq1Yv5HN/u14j8nzS+GA+Hs+7dRhovKEMYOw8UoZa2Bnf0WUxpkX1Ub2SYCaIM WCZWKY4a/hf/bcK+7xVX6IMq0ecW2njR5662R3PZCfiH0jALpy+w+1Ix4p23gtD6 OjD2hETd2yaYbVSJ2qccZSBjBoZ/AqtFLYEewVDtSX8XHQuWrE1Gg9k/3nn4rCKU KfHDDVaCnQ2K05okfIaw3vCy+zzHejabgM+jqmXORz//DsewMcmO2sZb6D751dRq xDPgBJfZUHSo8qZWokF0z5QQ7CXuBLlw5lTOo+wKS6r3Cw53dHg=
=pBLk
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Mathias,
Am Thu, May 15, 2025 at 03:52:06AM +0000 schrieb Mathias Gibbens:

Indeed, that looks unusual. I did find one old report on the debian-
user list that's similar, but was ultimately unsolved[0].

If you're getting two duplicate emails, that indicates logcheck is
running from both the crontab and new systemd timer. In that case, can
you share the contents of /etc/cron.d/logcheck? If you had locally
modified that file, it might not have been properly updated to not run
in a systemd environment.

# /etc/cron.d/logcheck: crontab entries for the logcheck package
# These do nothing under systemd because the systemd timer will take precedence

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root

@reboot logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck -R; fi
2 * * * * logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi

Richard provided several good things to check that will help track
down the root cause of this issue.

I answerd all but one there.

Thanks for the analysis so far and your efforts.

Greetings

Helge

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgmOc0ACgkQQbqlJmgq 5nCNUQ/+N8iTqb+DMQi6h9R7yBq2Gc1t32iY4/6eUp/SOoNi5OUF6ScccB/o0CAt ixcdmwt0VXqB0qoiR6Z0oqGkVDk9kcDKg4MgU0Zvjzuze5mSO02qjzl7AzeOlnIE NW9sEQx1vQoKWK4NYtf0ONjvLCqiHoEdP3jB19RyOVKCJrwGeRnBolD9VxWZd/Ee tiYYNijho8eQ1aIa5t3ybkekyHnTuDMXhO9o0cW6T9pyPRG/kZTqz+0V/XhDlwDY oDhomOY+R/EQ7gMkigliNqxelfSlytrXNu8DCNzy8QnrF5SdSDZYafbwOhFZ+pIQ KzYd9axPOP7LdWhTZDPf50AlmhEfRVtHZ/SqB/OrrxcvBniauzn9AQ+eMn3SGP/S u+yQtMN9PQfyrjC799xeMCFaGtc6s9QIcwGtJ10qIxDRMcRaYNdpz9djNbSCtEzv K3YP9u9NRXCGxzn1E59dYunLqHuoXzKIefqkYCvXdKXgf/SctUELZkJmC6L6+MGs HoM77lTaVIoCQrC72xsATG4wNwlTmF91q/2CwcUSGLJnXffbmldBGRnuVrUXIADq ydqgLqbXefkYc7uSpLjxAEIohkUIrixlU16T7uU

On Thu, 15 May 2025 at 19:58, Helge Kreutzmann <debian@helgefjell.de> wrote:

Hello Richard,
Am Wed, May 14, 2025 at 10:55:48PM +0100 schrieb Richard Lewis:

On Wed, 14 May 2025 at 20:36, Helge Kreutzmann <debian@helgefjell.de> wrote:

Since todays update of logcheck I get every message twice,

does message mean every email, email from logcheck, or line in the
logceck report?

Every e-mail comes twice. But at different times, i.e. it take a while
until the 2nd e-mail comes. In my sample the first one comes 2 minutes
past the hour, the 2nd one arrives 7 - 17 minutes later.

this does sound like both the cron and journal are running, which
shouldnt happen
what is the output of

systemctl list-timers --all logcheck

Otherwise the e-mails look the same (except the deilvery date).

is this perhaps because logcheck is reporting messages that are in the journal and rsyslog? (it should!)

Maybe.

if the emails come at different times then this shouldnt be the issue

2025-05-14T19:02:04.733378+02:00 twentytwo exim[42129]: 2025-05-14 19:02:04 1uFFUa-00000000AxR-2z0z failed to write to main log: length=98 result=-1 errno=9 (Bad file descriptor)
2025-05-14T19:02:04.735285+02:00 twentytwo exim[42129]: write failed on panic log: length=123 result=-1 errno=9 (Bad file descriptor)

Since exim (also in conjunction with previous logcheck) works fine

this is exim saying that it was unable to write to
/var/log/exim4/paniclog and failing - this very much suggests exim is
not working fine
if you are getting an emial from logcheck then that suggests logcheck
is doing it's job and showing an issue.

I can downgrade logcheck to see if this goes away as well. But in the
exim logs themselves I could not see any issue, also there is more
than sufficient space on all relevant partitions.

i would think this is systemd hardening, but there isnt any.

what are the permissions on /var/log/exim4/ and

drwxr-s--- 2 Debian-exim adm 4096 15. Mai 19:40 /var/log/exim4/

is anything in paniclog?

There is no such file on my system.

permissions look fine - is the logcheck user in the adm group? (grep
logcheck /etc/group )

what is in exim log (/var/log/exim4/mainlog and
/var/log/exim4/rejectlog) for the mail?

what lines are in the journal when logcheck runs?

Well, I see the following:
Mai 15 20:02:01 twentytwo CRON[18514]: pam_unix(cron:session): session opened for user logcheck(uid=113) by logcheck(uid=0)
Mai 15 20:02:01 twentytwo systemd[1]: Starting logcheck.service - logcheck... Mai 15 20:02:01 twentytwo CRON[18517]: (logcheck) CMD ( if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)
Mai 15 20:02:01 twentytwo CRON[18514]: pam_unix(cron:session): session closed for user logcheck
Mai 15 20:02:08 twentytwo systemd[1]: logcheck.service: Deactivated successfully.
Mai 15 20:02:08 twentytwo systemd[1]: Finished logcheck.service - logcheck. Mai 15 20:02:08 twentytwo systemd[1]: logcheck.service: Consumed 7.038s CPU time, 249.2M memory peak.

But I'm no journal expert, I primarily look at the classic logs.

this looks ok to me, i think: looks like the cron did nothing but the
timer ran (just check: this should say systemd:

if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then
echo "cron" else echo "systemd"; fi

what about at the time of the second mail?

what happens if you run logcheck manually? with the -d option?

I'll check that later.

it's especially the part where it sends the email that might help

what is in logcheck.conf?

The non empty/non comment lines are:
REPORTLEVEL="server"
SENDMAILTO="logcheck"

looks fine - does sending a mail to the logcheck user work? what is
grep logcheck /etc/aliases

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
first of all, to test other configuration, I downgraded logcheck to
the previous version - now everything is back to normal. So this is not
an exim issue or so, but is clearly caused by the updated package. (Logcheck is running on this machines for many years).

For further reporting, I return to the current version with the bugs.

Am Thu, May 15, 2025 at 09:29:41PM +0100 schrieb Richard Lewis:

On Thu, 15 May 2025 at 19:58, Helge Kreutzmann <debian@helgefjell.de> wrote:

Am Wed, May 14, 2025 at 10:55:48PM +0100 schrieb Richard Lewis:

On Wed, 14 May 2025 at 20:36, Helge Kreutzmann <debian@helgefjell.de> wrote:

Since todays update of logcheck I get every message twice,

does message mean every email, email from logcheck, or line in the logceck report?

Every e-mail comes twice. But at different times, i.e. it take a while until the 2nd e-mail comes. In my sample the first one comes 2 minutes
past the hour, the 2nd one arrives 7 - 17 minutes later.

this does sound like both the cron and journal are running, which
shouldnt happen
what is the output of

systemctl list-timers --all logcheck

NEXT LEFT LAST PASSED UNIT ACTIVATES
Fri 2025-05-16 19:02:00 CEST 47min Fri 2025-05-16 18:02:01 CEST 12min ago logcheck.timer logcheck.service

1 timers listed.

what are the permissions on /var/log/exim4/ and

drwxr-s--- 2 Debian-exim adm 4096 15. Mai 19:40 /var/log/exim4/

is anything in paniclog?

There is no such file on my system.

permissions look fine - is the logcheck user in the adm group? (grep
logcheck /etc/group )

adm:x:4:logcheck
systemd-journal:x:101:logcheck
logcheck:x:123:

what is in exim log (/var/log/exim4/mainlog and
/var/log/exim4/rejectlog) for the mail?

...
2025-05-16 18:02:04 1uFxVc-000000006vP-3jA0 <= logcheck@twentytwo.helgefjell.de U=logcheck P=local S=1809
2025-05-16 18:10:02 1uFxdJ-0000000072V-2j7j <= kreutzmannhelge@helgefjell.de H=(twentytwo.helgefjell.de) [::1] P=esmtp S=5865 id=courier.00000000682761A0.0039B067@mail.helgefjell.de
2025-05-16 18:10:02 1uFxdJ-0000000072V-2j7j => helge <helge@localhost> R=procmail T=procmail_pipe
2025-05-16 18:10:02 1uFxdJ-0000000072V-2j7j Completed
2025-05-16 18:10:02 1uFxdJ-0000000072V-32XW <= kreutzmannhelge@helgefjell.de H=(twentytwo.helgefjell.de) [::1] P=esmtp S=5184 id=courier.00000000682761A0.0039B06F@mail.helgefjell.de
2025-05-16 18:10:02 1uFxdJ-0000000072V-32XW => helge <helge@localhost> R=procmail T=procmail_pipe
2025-05-16 18:10:02 1uFxdJ-0000000072V-32XW Completed
...

The last rejectlog is from December 2024.

what lines are in the journal when logcheck runs?

Well, I see the following:
Mai 15 20:02:01 twentytwo CRON[18514]: pam_unix(cron:session): session opened for user logcheck(uid=113) by logcheck(uid=0)
Mai 15 20:02:01 twentytwo systemd[1]: Starting logcheck.service - logcheck...
Mai 15 20:02:01 twentytwo CRON[18517]: (logcheck) CMD ( if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)
Mai 15 20:02:01 twentytwo CRON[18514]: pam_unix(cron:session): session closed for user logcheck
Mai 15 20:02:08 twentytwo systemd[1]: logcheck.service: Deactivated successfully.
Mai 15 20:02:08 twentytwo systemd[1]: Finished logcheck.service - logcheck. Mai 15 20:02:08 twentytwo systemd[1]: logcheck.service: Consumed 7.038s CPU time, 249.2M memory peak.

But I'm no journal expert, I primarily look at the classic logs.

this looks ok to me, i think: looks like the cron did nothing but the
timer ran (just check: this should say systemd:

if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then
echo "cron" else echo "systemd"; fi

Yes:
# These do nothing under systemd because the systemd timer will take precedence

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root

@reboot logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck -R; fi
2 * * * * logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi

what about at the time of the second mail?

It comes a random time afterwards, sometime > 20 minutes later.

what happens if you run logcheck manually? with the -d option?

I get a logcheck e-mail, this time with the panic only: 2025-05-16T18:02:04.908386+02:00 twentytwo exim[26627]: 2025-05-16 18:02:04 1uFxVc-000000006vP-3jA0 failed to write to main log: length=98 result=-1 errno=9 (Bad file descriptor)
2025-05-16T18:02:04.910317+02:00 twentytwo exim[26627]: write failed on panic log: length=123 result=-1 errno=9 (Bad file descriptor)

With -d:

I get tons of output, looks like my patterns and more, which ends in:

DEBUG: [Fr 16. Mai 18:26:35 CEST 2025] report (System Events): Nothing to report
DEBUG: [Fr 16. Mai 18:26:35 CEST 2025] Finished check for system events (SYSTEM=0)
DEBUG: [Fr 16. Mai 18:26:35 CEST 2025] Adding the footer to the report
DEBUG: [Fr 16. Mai 18:26:35 CEST 2025] Killing lockfile-touch - 30747
DEBUG: [Fr 16. Mai 18:26:35 CEST 2025] Removing lockfile: /run/lock/logcheck/logcheck.lock
DEBUG: [Fr 16. Mai 18:26:35 CEST 2025] cleanup: Removing working dir: /tmp/logcheck.3E1ZGG
DEBUG: [Fr 16. Mai 18:26:35 CEST 2025] cleanup: Done

it's especially the part where it sends the email that might help

what is in logcheck.conf?

The non empty/non comment lines are:
REPORTLEVEL="server"
SENDMAILTO="logcheck"

looks fine - does sending a mail to the logcheck user work? what is
grep logcheck /etc/aliases

logcheck: root

Maybe you check your updates from the last version and maybe I can
locally mask/undo them to find out which causes the problem?

Greetings

Helge

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgnZ9sACgkQQbqlJmgq 5nBNnQ/9E7/0Ery/gJmBCDMaouI426vaW8+clYdiJbHuOgoUHaS8k3zfTy3i6ZJI YxAGddyRFqSWH/Vp6u6Zo7QDKsUboiI+BbVImWcbfwnEYV1dyfm3qVPKWuA6FeNr whiMXTJ92noR+3YqpG2d1Gl1r28AXjzP6SlILBkqBHXIUcM6DQFvFbnHWSrHNRG+ 4GLltFAPTSPBivxZXLH2Uc71MCR3LB1h8Br99BolHA8moDxZO592WQfavSpVPQ5l X4tVUs9yYXHz3zwchLtm+dTWwYkpjVlZhAZqgiRHPLDREpKBLiW42QqDAAM8dn+l wddTQr6YySjws/GoGNflkH4tqRlxc5lFnjBKpLzgwQcMH/cbegt9O0c9pt0yML2d ZM+slXuo9J552eAxUUSkUNy4pIWW5fP/+yT/BIBVJ3AeQTyXv07uKYgfBSJanp4t vMbZZYkSdeTa1IAGqzQC+7ERSVC/hIxV5EgGbD5Az5TjakrICl0jx7Ev0i1e76zR 7nchrAZQSoHsKLa4ukUSWZt6qatheitaL82GB0Hrxf1XT4eEQ9zI94XjzbT0Uws1 EMg9Od238L+01JhyN5CInYASIqoLGkz7x4aBrx5

On Fri, 16 May 2025, 17:29 Helge Kreutzmann, <debian@helgefjell.de> wrote:

Hello Richard,
first of all, to test other configuration, I downgraded logcheck to
the previous version - now everything is back to normal. So this is not
an exim issue or so, but is clearly caused by the updated package.
(Logcheck
is running on this machines for many years).

thanks - all the other lines looked ok, although am confused by the exim output --- my guess is that this is an issue with systemd units exim. i
didnt think this would affect the non-hardened unit, but:

can you edit the logcheck script, and add a "sleep 30s" to the "end' ,
after the point the email is sent -- make sure to pick a point that will actually be run, i cant look right now, but search for where mime-construct
is used. i think this may work --


i think that what is happening is: logcheck itself is ok, it makes the
report and hands it to exim corrextly. but the systemd unit is shut down
"too soon", while exim has taken in the mail - exim thinks something
failed, tries to write to paniclog but cannot (i dont know why, but i
suppose system closes all file descriptors.or.something). somehow exim
retries later and you get a duplicate delivery --.actually you could
check: is the mail id the same?. and if you run mailq between running
logcheck and getting the 2nd mail, do you see a frozen/deferred message

<div dir="auto"><div><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Fri, 16 May 2025, 17:29 Helge Kreutzmann, &lt;<a href="mailto:debian@helgefjell.de">debian@helgefjell.de</a>&gt; wrote:<br></div><blockquote class="
gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello Richard,<br>
first of all, to test other configuration, I downgraded logcheck to<br>
the previous version - now everything is back to normal. So this is not<br>
an exim issue or so, but is clearly caused by the updated package. (Logcheck <br>
is running on this machines for many years).<br></blockquote></div></div><div dir="auto"><br></div><div dir="auto">thanks - all the other lines looked ok, although  am confused by the exim output  ---  my guess is that this is an issue with systemd
units exim. i didnt think this would affect the non-hardened unit, but:</div><div dir="auto"><br></div><div dir="auto">can you edit the logcheck script, and add a &quot;sleep 30s&quot; to the &quot;end&#39; , after the point the email is sent -- make
sure to pick a point that will actually be run, i cant look right now, but search for where mime-construct is used. i think this may work -- </div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">i think that what is happening is: 
logcheck itself is ok, it makes the report and hands it to exim corrextly.  but the systemd unit is shut down &quot;too soon&quot;, while exim has taken in the mail - exim thinks something failed, tries to write to paniclog but cannot (i dont know why,
but i suppose system closes all file descriptors.or.something). somehow exim retries later and you get a duplicate delivery  --.actually you could check: is the mail id the same?. and if you run mailq between running logcheck and getting the 2nd mail,
do you see a frozen/deferred message</div></div>

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
Am Fri, May 16, 2025 at 06:02:55PM +0100 schrieb Richard Lewis:

On Fri, 16 May 2025, 17:29 Helge Kreutzmann, <debian@helgefjell.de> wrote:

Hello Richard,
first of all, to test other configuration, I downgraded logcheck to
the previous version - now everything is back to normal. So this is not
an exim issue or so, but is clearly caused by the updated package. (Logcheck
is running on this machines for many years).

thanks - all the other lines looked ok, although am confused by the exim output --- my guess is that this is an issue with systemd units exim. i didnt think this would affect the non-hardened unit, but:

can you edit the logcheck script, and add a "sleep 30s" to the "end' ,
after the point the email is sent -- make sure to pick a point that will actually be run, i cant look right now, but search for where mime-construct is used. i think this may work --

I'm not sure I understand what I should do, sorry.

i think that what is happening is: logcheck itself is ok, it makes the report and hands it to exim corrextly. but the systemd unit is shut down "too soon", while exim has taken in the mail - exim thinks something
failed, tries to write to paniclog but cannot (i dont know why, but i
suppose system closes all file descriptors.or.something). somehow exim retries later and you get a duplicate delivery --.actually you could
check: is the mail id the same?. and if you run mailq between running logcheck and getting the 2nd mail, do you see a frozen/deferred message

What exact change *in logcheck* could have triggered this? Is there
anythin *in logcheck* I can (temporarily) disable, like bisecting the difference between the previous version and the current one?

If not, maybe it is better to return to the previous one, as we are in
the hard freeze now[1] …

Greetings

Helge

[1] I don't want my future stable machines to send every mail twice
with an exim error for the next years …

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgneKUACgkQQbqlJmgq 5nC6fg/9GRDLIw37M0G6D7ofFG0HgsxMiXcXn82haaQMWY53leyhvcPfVSKxQOXQ +XZzGzXkrZsMVWyYfP/YfxY/v1QZw1w9LEXmYjVal7eNTTAbT+bCPubOCJg9Lb0k w+Cv/xjv6SDiXnW554ogTtmFPzJ2tf5TtqxTTiIPmrxWsY33G72/g6jaOch5+0Eq S/v2bL2cXk0IkDg4Qj+Y4oM1vRypcXkOgssbxH9PIzpBlZNgMBdMiKiducNd7aEv tVsfU+XPzwWfOHnzrXMcnCS9HpMNNBnbmPK3FpHV8N8ozDV4LthF5jbGJ6gk9Mnc YsXPpg1OcQndefdDjMQMJKKhFqzTu1H8MQSba54S+aLuqkf235PD3xswEv/v8MD9 Btg55ey8WGrDMp3FjLqbrTAlVMX6vT+Fp1ttu6tQzmVB2Jee7FriNi/Klg2CVtk7 T/DgBrEjh7WG2nCOPRqzzWsiF4Agh4iisTEVyLstvr/KSYSaMGMysmHcbg7EtMrz O5nhevOGVpveINdeXY+Q1N0C+j+Ia361Ykmd/jIdBLEVX/SQB54a0QioVRC6aXhv VTZFdqukZZxMsFqt/6d7ieqEYnwdEBYLeubyXiH

On Fri, 16 May 2025, 18:40 Helge Kreutzmann, <debian@helgefjell.de> wrote:

Hello Richard,
Am Fri, May 16, 2025 at 06:02:55PM +0100 schrieb Richard Lewis:

On Fri, 16 May 2025, 17:29 Helge Kreutzmann, <debian@helgefjell.de>

wrote:

Hello Richard,
first of all, to test other configuration, I downgraded logcheck to
the previous version - now everything is back to normal. So this is not an exim issue or so, but is clearly caused by the updated package. (Logcheck
is running on this machines for many years).

thanks - all the other lines looked ok, although am confused by the exim output --- my guess is that this is an issue with systemd units exim. i didnt think this would affect the non-hardened unit, but:

can you edit the logcheck script, and add a "sleep 30s" to the "end' , after the point the email is sent -- make sure to pick a point that will actually be run, i cant look right now, but search for where

mime-construct

is used. i think this may work --

I'm not sure I understand what I should do, sorry.

https://salsa.debian.org/debian/logcheck/-/blob/debian/sid/src/logcheck?ref_type=heads#L328

add a new line with a " sleep 30 " before the return (and after the call to mime-construct (30 seconds is way too long - probably 10s is enough!)

What exact change *in logcheck* could have triggered this?

the use of a systemd timer


Is there

anythin *in logcheck* I can (temporarily) disable, like bisecting the difference between the previous version and the current one?

you could also try and confirm it works if systemd is not used

systemctl disable logcheck.timer
edit the cron.d and remove the code that disables it - logcheck will then
run from cron


If not, maybe it is better to return to the previous one, as we are in

the hard freeze now[1] …

or, if the fix can be found it can be added to trixie - but we need to
confirm the issue and fix first.

<div dir="auto"><div><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Fri, 16 May 2025, 18:40 Helge Kreutzmann, &lt;<a href="mailto:debian@helgefjell.de">debian@helgefjell.de</a>&gt; wrote:<br></div><blockquote class="
gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello Richard,<br>
Am Fri, May 16, 2025 at 06:02:55PM +0100 schrieb Richard Lewis:<br>
&gt; On Fri, 16 May 2025, 17:29 Helge Kreutzmann, &lt;<a href="mailto:debian@helgefjell.de" target="_blank" rel="noreferrer">debian@helgefjell.de</a>&gt; wrote:<br>
&gt; <br>
&gt; &gt; Hello Richard,<br>
&gt; &gt; first of all, to test other configuration, I downgraded logcheck to<br>
&gt; &gt; the previous version - now everything is back to normal. So this is not<br>
&gt; &gt; an exim issue or so, but is clearly caused by the updated package.<br>
&gt; &gt; (Logcheck<br>
&gt; &gt; is running on this machines for many years).<br>
&gt; &gt;<br>
&gt; <br>
&gt; thanks - all the other lines looked ok, although  am confused by the exim<br>
&gt; output  ---  my guess is that this is an issue with systemd units exim. i<br>
&gt; didnt think this would affect the non-hardened unit, but:<br>
&gt; <br>
&gt; can you edit the logcheck script, and add a &quot;sleep 30s&quot; to the &quot;end&#39; ,<br>
&gt; after the point the email is sent -- make sure to pick a point that will<br>
&gt; actually be run, i cant look right now, but search for where mime-construct<br>
&gt; is used. i think this may work --<br>

I&#39;m not sure I understand what I should do, sorry.</blockquote></div></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><a href="https://salsa.debian.org/debian/logcheck/-/blob/debian/sid/src/logcheck?
ref_type=heads#L328">https://salsa.debian.org/debian/logcheck/-/blob/debian/sid/src/logcheck?ref_type=heads#L328</a></div><div dir="auto"><br></div><div dir="auto">add a new line with a &quot; sleep 30 &quot; before the return (and after the call to mime-
construct (30 seconds is way too long - probably 10s is enough!)</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote gmail_quote_container"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;
border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>

What exact change *in logcheck* could have triggered this? </blockquote></div></div><div dir="auto"><br></div><div dir="auto">the use of a systemd timer</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote
gmail_quote_container"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Is there<br>
anythin *in logcheck* I can (temporarily) disable, like bisecting the<br> difference between the previous version and the current one?<br></blockquote></div></div><div dir="auto"><br></div><div dir="auto">you could also try and confirm it works if systemd is not used</div><div dir="auto"><br></div><div dir="auto">systemctl
disable logcheck.timer</div><div dir="auto">edit the cron.d and remove the code that disables it - logcheck will then run from cron </div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote gmail_quote_container"><
blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">If not, maybe it is better to return to the previous one, as we are in<br>
the hard freeze now[1] …<br></blockquote></div></div><div dir="auto"><br></div><div dir="auto">or, if the fix can be found it can be added to trixie - but we need to confirm the issue and fix first.</div></div>

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
Am Fri, May 16, 2025 at 06:58:44PM +0100 schrieb Richard Lewis:

On Fri, 16 May 2025, 18:40 Helge Kreutzmann, <debian@helgefjell.de> wrote:

Am Fri, May 16, 2025 at 06:02:55PM +0100 schrieb Richard Lewis:

On Fri, 16 May 2025, 17:29 Helge Kreutzmann, <debian@helgefjell.de>

wrote:

Hello Richard,
first of all, to test other configuration, I downgraded logcheck to
the previous version - now everything is back to normal. So this is not an exim issue or so, but is clearly caused by the updated package. (Logcheck
is running on this machines for many years).

thanks - all the other lines looked ok, although am confused by the exim output --- my guess is that this is an issue with systemd units exim. i didnt think this would affect the non-hardened unit, but:

can you edit the logcheck script, and add a "sleep 30s" to the "end' , after the point the email is sent -- make sure to pick a point that will actually be run, i cant look right now, but search for where

mime-construct

is used. i think this may work --

I'm not sure I understand what I should do, sorry.

https://salsa.debian.org/debian/logcheck/-/blob/debian/sid/src/logcheck?ref_type=heads#L328

add a new line with a " sleep 30 " before the return (and after the call to mime-construct (30 seconds is way too long - probably 10s is enough!)

Ok, I added it. So I can report tomorrow what (if) changed.

What exact change *in logcheck* could have triggered this?

the use of a systemd timer

Looks like a big change so late in the cylce, but then I'm not a
systemd expert.

Is there

anythin *in logcheck* I can (temporarily) disable, like bisecting the difference between the previous version and the current one?

you could also try and confirm it works if systemd is not used

systemctl disable logcheck.timer
edit the cron.d and remove the code that disables it - logcheck will then
run from cron

Is this additional to the above change or alternative?

If not, maybe it is better to return to the previous one, as we are in

the hard freeze now[1] …

or, if the fix can be found it can be added to trixie - but we need to confirm the issue and fix first.

Well, we are in the hard freeze right now, not at the beginning or the
middle of the Trixi development.

But where possible, I can supply you with information.

Greetings

Helge

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgnhWAACgkQQbqlJmgq 5nAN+BAAp2cZb7PRE/d6kWXcTb0VOTuZVm55P9JgUzfTVL8wTc9IW8j7PvWxRpwA Dkoz5Mxk9jGa93X/gX3nRyk2jIENUbdj3/4OIQ1Pi0yRVW78ZvUjfw9/5Epi7q/U qRhsDsHuQoHaB+BOD50wJVBmOt8FqAgAEwyOj4thGPE2/1nKHPLDn0xgojefJbA8 C45Lc9CfnCPctZRXCiSsfwvxk9ViDAcHIm+r7CqINR9rj3LuiuBE1xtHFN9s7xMG o/NIewsY6FgQVSKA7rlM9um7kY2jwUrLLfLeXciIInuyP1uBXwYBIfP7//YM26Kc k46tH5q4RLpf0CwhflGP+/559/sIHOfUF0cwokcFkHDahaAhSKLzuklnGbkZtyaV DusGJeUCxAC/PkL1QrOWgfdASYZ6eWhiZxFOTJUjOKu0QFqbUVW2IhjqCMdHYdz2 wEGRHwQtRXrA73EM0Z/tpZfLPdEdlTh6fg2ljm9+tPo54tWvLJoxyYR6P5lcxPrt Vo4JD67F6gj0wD/wOpXaJEvUa4t9SmLOnBiQ49rd8zo08LJKGBMfdjIfMW8dGqxl Zz1deV3xOO9A8OWNg00jRTA9QjkT/LjWc8XgGHR

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
Am Fri, May 16, 2025 at 06:35:14PM +0000 schrieb Helge Kreutzmann:

Am Fri, May 16, 2025 at 06:58:44PM +0100 schrieb Richard Lewis:

https://salsa.debian.org/debian/logcheck/-/blob/debian/sid/src/logcheck?ref_type=heads#L328

add a new line with a " sleep 30 " before the return (and after the call to mime-construct (30 seconds is way too long - probably 10s is enough!)

Ok, I added it. So I can report tomorrow what (if) changed.

I can see only a slight change. The exim error is the same, and two mails arrive, one shortly after the hour, but the 2nd one always 24 minutes later (before this, the 2nd mail arrived at a non deterministic time).

Does this help you?

Should I now undo this change and go for the 2nd change?

Greetings

Helge


--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgoSRYACgkQQbqlJmgq 5nAhlxAAkbJKsLf4UMiPAYlMX2gbonYfloMGIUNYUFB/API7yJbyg+lQRXkRm2hQ R1S/dGHhY48mzJWUWiaiigX/aTmfAwBBROiiheaJgf37N+ktpe3fAAnnj2WKRkr5 uOqFn+Z0N36iozOlI2VeHkKgzPzk1RAI3Bddz75AFn6F/wvWzGBDdKhMJK2KihsJ UdPR2xFbPixcZQtHUaJOOVM//o722FD1PLiE14E83xPQXDQd8tOlmqPp0RLtE1RP dAkCwT0OUpEOiizzR9Jk7+dlqPloh58GPo1PWM+MRXJi9FeXQHi/pe7G07oyXIdw vn+2uDPU/X6i0D5hhZWEs61ctzyCvemtqu7gF+TCtpHC4jWVzivZdgrdiGfH0tc6 NW2XIbnXWxBJwNb2knxb0i5TH/qR9QuCdS1+sXRq55qfcPOSz/wGJpMOLZ+Dg77O 3BpLefNh+3NK8SX5oS5mil4B7GFa8HkizKNPyYEqDu9s+itv4aROo00KtBgX9HrV 7/WOEMD6NalV0huVQ6h0WcyFaYiK/y8pPu/KwbFrWa7dZRJyMpZapll6OrG2lgeQ MoHijTksucbk0kTbgKDH1y5YhJjGk/TnwQhBKm8

On Sat, 17 May 2025, 09:30 Helge Kreutzmann, <debian@helgefjell.de> wrote:

Hello Richard,
Am Fri, May 16, 2025 at 06:35:14PM +0000 schrieb Helge Kreutzmann:

Am Fri, May 16, 2025 at 06:58:44PM +0100 schrieb Richard Lewis:

https://salsa.debian.org/debian/logcheck/-/blob/debian/sid/src/logcheck?ref_type=heads#L328

add a new line with a " sleep 30 " before the return (and after the

call to

mime-construct (30 seconds is way too long - probably 10s is enough!)

Ok, I added it. So I can report tomorrow what (if) changed.

I can see only a slight change. The exim error is the same, and two mails arrive, one shortly after the hour, but the 2nd one always 24 minutes later (before this, the 2nd mail arrived at a non deterministic time).

Does this help you?

hmm... not what i was expecting!

what happens if you run mailq between the 2 emails arriving - is there
perhaps something frozen?

what is in the exim mainlog for the 2nd email?

Should I now undo this change and go for the 2nd change?

i think that would at least confirm if this is systemd+exim-related in the
way i suspect

<div dir="auto"><div><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Sat, 17 May 2025, 09:30 Helge Kreutzmann, &lt;<a href="mailto:debian@helgefjell.de">debian@helgefjell.de</a>&gt; wrote:<br></div><blockquote class="
gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello Richard,<br>
Am Fri, May 16, 2025 at 06:35:14PM +0000 schrieb Helge Kreutzmann:<br>
&gt; Am Fri, May 16, 2025 at 06:58:44PM +0100 schrieb Richard Lewis:<br>
&gt; &gt; <a href="https://salsa.debian.org/debian/logcheck/-/blob/debian/sid/src/logcheck?ref_type=heads#L328" rel="noreferrer noreferrer" target="_blank">https://salsa.debian.org/debian/logcheck/-/blob/debian/sid/src/logcheck?ref_type=heads#L328</a><br>
&gt; &gt; <br>
&gt; &gt; add a new line with a &quot; sleep 30 &quot; before the return (and after the call to<br>
&gt; &gt; mime-construct (30 seconds is way too long - probably 10s is enough!)<br>
&gt; <br>
&gt; Ok, I added it. So I can report tomorrow what (if) changed.<br>

I can see only a slight change. The exim error is the same, and two mails<br> arrive, one shortly after the hour, but the 2nd one always 24 minutes later<br> (before this, the 2nd mail arrived at a non deterministic time).<br>

Does this help you?<br></blockquote></div></div><div dir="auto"><br></div><div dir="auto">hmm... not what i was expecting! </div><div dir="auto"><br></div><div dir="auto">what happens if you run mailq between the 2 emails arriving - is there perhaps
something frozen?</div><div dir="auto"><br></div><div dir="auto">what is in the exim mainlog for the 2nd email?</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote gmail_quote_container"><blockquote class="
gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">

Should I now undo this change and go for the 2nd change?<br></blockquote></div></div><div dir="auto"><br></div><div dir="auto">i think that would at least confirm if this is systemd+exim-related in the way i suspect</div></div>

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
Am Sat, May 17, 2025 at 11:12:05AM +0100 schrieb Richard Lewis:

On Sat, 17 May 2025, 09:30 Helge Kreutzmann, <debian@helgefjell.de> wrote:

Am Fri, May 16, 2025 at 06:35:14PM +0000 schrieb Helge Kreutzmann:

Am Fri, May 16, 2025 at 06:58:44PM +0100 schrieb Richard Lewis:

https://salsa.debian.org/debian/logcheck/-/blob/debian/sid/src/logcheck?ref_type=heads#L328

add a new line with a " sleep 30 " before the return (and after the

call to

mime-construct (30 seconds is way too long - probably 10s is enough!)

Ok, I added it. So I can report tomorrow what (if) changed.

I can see only a slight change. The exim error is the same, and two mails arrive, one shortly after the hour, but the 2nd one always 24 minutes later (before this, the 2nd mail arrived at a non deterministic time).

Does this help you?

hmm... not what i was expecting!

what happens if you run mailq between the 2 emails arriving - is there perhaps something frozen?

For the next one:

root@twentytwo:~# mailq
13m 3.0K 1uGEMm-00000000KGp-1rQA <logcheck@twentytwo.helgefjell.de>
logcheck@twentytwo.helgefjell.de

what is in the exim mainlog for the 2nd email?

For the previous run:
2025-05-17 11:10:01 1uGDYP-00000000It2-0waZ <= kreutzmannhelge@helgefjell.de H=(twentytwo.helgefjell.de) [::1] P=esmtp S=6850 id=courier.00000000682850E3.000D35BC@mail.helgefjell.de
2025-05-17 11:10:02 1uGDYP-00000000It2-0waZ => helge <helge@localhost> R=procmail T=procmail_pipe
2025-05-17 11:10:02 1uGDYP-00000000It2-0waZ Completed
2025-05-17 11:10:02 1uGDYP-00000000It2-1FK6 <= kreutzmannhelge@helgefjell.de H=(twentytwo.helgefjell.de) [::1] P=esmtp S=7008 id=courier.00000000682850E3.000D35C4@mail.helgefjell.de
2025-05-17 11:10:03 1uGDYP-00000000It2-1FK6 => helge <helge@localhost> R=procmail T=procmail_pipe
2025-05-17 11:10:03 1uGDYP-00000000It2-1FK6 Completed
2025-05-17 11:26:45 Start queue run: pid=73727
2025-05-17 11:26:45 1uGDQi-00000000Ign-2mF0 => helge <logcheck@twentytwo.helgefjell.de> R=procmail T=procmail_pipe
2025-05-17 11:26:45 1uGDQi-00000000Ign-2mF0 Completed
2025-05-17 11:26:45 End queue run: pid=73727

(The entrys at 11:02 o'clock are when the mails get initiated, as you can
see, at 11:26 o'clock the 2nd one was deliverd.

Should I now undo this change and go for the 2nd change?

i think that would at least confirm if this is systemd+exim-related in the way i suspect

So I will undo the manual change for the logcheck script after the delivery
of the 2nd mail?

Greetings

Helge

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgoYowACgkQQbqlJmgq 5nDHhA//V1K2ZdoglSkvU4NeuohE3y4QJzJUX8oWYM3uxCditAgQLJyPUJT3WyKZ 1jUfpc17Pob6SifPtYCjUwdwnLgWao3CVIR2+5JtMRdAIoTh56KVSlYad1oZvCP4 /Ilj0cxqoWsUTdU3bWCpYKhdyeOpz+mz6QKZ02HMf3+0nzHMcC8qvAAa2rI7hUrf 1X7Q7PH5uxnaM4tkqoa++pB9w5byyorjoyHAYT3NbSSQSN6/GTNdoXBmU4H+t0WS Jv7gbSCVDJUHlO9ibvOa/PEaZtS5PXUak4lxS9Su6L46erN6HGdjQPlfIfulpJ2c 4lEWRjpBKo2XtPGSMO+BZp8mfP/Sz1X5/+9x+vrrTiu6pW9+9U/53gGb8HwBGSMY JFlJTAT5I6dTR+cWLMTA+7qEp7ldG3kHAhqKCD0oJ6IKmrtFG2ItRYS7ZeVDUAlP 9ezwINA0tjh+SKrOjQYKNAPVVdrWA14Xyp/5iOUcNRd21ghlAfsI0v30IYbVTavK 4siqx7+fh0nMDafe1J9Z9mGUkHQSMAc4ErPACfFnPuW87SEeSm1pkyoftaFMYk1N LL/34DNzqmul26C40/ocQLDYWonMDquvBiQmp7A

On Sat, 17 May 2025, 11:18 Helge Kreutzmann, <debian@helgefjell.de> wrote:

Hello Richard,
Am Sat, May 17, 2025 at 11:12:05AM +0100 schrieb Richard Lewis:

On Sat, 17 May 2025, 09:30 Helge Kreutzmann, <debian@helgefjell.de>

wrote:

Am Fri, May 16, 2025 at 06:35:14PM +0000 schrieb Helge Kreutzmann:

Am Fri, May 16, 2025 at 06:58:44PM +0100 schrieb Richard Lewis:

https://salsa.debian.org/debian/logcheck/-/blob/debian/sid/src/logcheck?ref_type=heads#L328

add a new line with a " sleep 30 " before the return (and after the

call to

mime-construct (30 seconds is way too long - probably 10s is

enough!)

Ok, I added it. So I can report tomorrow what (if) changed.

I can see only a slight change. The exim error is the same, and two

mails

arrive, one shortly after the hour, but the 2nd one always 24 minutes

later

(before this, the 2nd mail arrived at a non deterministic time).

Does this help you?

hmm... not what i was expecting!

what happens if you run mailq between the 2 emails arriving - is there perhaps something frozen?

For the next one:

root@twentytwo:~# mailq
13m 3.0K 1uGEMm-00000000KGp-1rQA <logcheck@twentytwo.helgefjell.de>
logcheck@twentytwo.helgefjell.de

aha, so this is what i thought --exim is getting the email, delivering it immediately but -- for some reason -- also keeping a copy in the queue. the
2nd email is happening when exim does its regular queue processing.

this usually happens when systemd prevented exim from writing to whatever database it uses. although 1. i have never seen 2 copies like this and 2. there's no systemd hardening in the debian unit.

could systemd have changed something?

what is in the exim mainlog for the 2nd email?

For the previous run:
2025-05-17 11:10:01 1uGDYP-00000000It2-0waZ <=
kreutzmannhelge@helgefjell.de H=(twentytwo.helgefjell.de) [::1] P=esmtp S=6850 id=courier.00000000682850E3.000D35BC@mail.helgefjell.de
2025-05-17 11:10:02 1uGDYP-00000000It2-0waZ => helge <helge@localhost> R=procmail T=procmail_pipe

hmm. this doesnt look like a default exim configuration to me? -- what is
the role of procmail on this system? ( it should be a local route and
transport here, but is doing esmtp??)

why are there several variations of the hostname/mailname? you've got the system appearing as twentytwo.helgefjell.de but also helgefjell.de and mail. helgefjell.de <kreutzmannhelge@helgefjell.de> (and later just localhost)
and it seems to be delivering the mail over smtp rather than local delivery
--- even if you run your own email service it shouldnt be doing that! is
there a mismatch between the names in /etc/mailname the name in /etc/hosts
the hostname and the dns records for those domains? (i dont know why that
would cause this, if other mails to the logcheck user work)

2025-05-17 11:10:02 1uGDYP-00000000It2-0waZ Completed


so there is one mail from kreutzmannhelge@helgefjell.de to helge@localhost

2025-05-17 11:10:02 1uGDYP-00000000It2-1FK6 <= kreutzmannhelge@helgefjell.de

H=(twentytwo.helgefjell.de) [::1] P=esmtp S=7008 id= courier.00000000682850E3.000D35C4@mail.helgefjell.de
2025-05-17 11:10:03 1uGDYP-00000000It2-1FK6 => helge <helge@localhost>

and a 2nd one

R=procmail T=procmail_pipe

2025-05-17 11:10:03 1uGDYP-00000000It2-1FK6 Completed

message was queued for sending but it does not realise it was delivered - messae is in a queue. (i have seen this happen when


2025-05-17 11:26:45 Start queue run: pid=73727

2025-05-17 11:26:45 1uGDQi-00000000Ign-2

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
now only the exim log, without any interfering procmail/cron job. So
only logcheck activity:

2025-05-17 15:02:03 1uGHAx-00000000OwY-3COi <= logcheck@twentytwo.helgefjell.de U=logcheck P=local S=4087
2025-05-17 15:26:45 Start queue run: pid=97614
2025-05-17 15:26:45 1uGHAx-00000000OwY-3COi => helge <logcheck@twentytwo.helgefjell.de> R=procmail T=procmail_pipe
2025-05-17 15:26:45 1uGHAx-00000000OwY-3COi Completed
2025-05-17 15:26:45 End queue run: pid=97614

But yes, somehow lgocheck is still involved.

In /etc/exim4 three files mention procmail:

exim4-config: /etc/exim4/conf.d/transport/30_exim4-config_procmail_pipe exim4-config: /etc/exim4/conf.d/router/700_exim4-config_procmail
exim4-config: /etc/exim4/exim4.conf.template

But I never edited them directly, only via Debconf (probably when I
installed the machine.

So it seems the new logcheck interacts badly with exim, if procmail is installed …

Should I temporarily move away (one by one) those two files in conf.d
to see if it helps? (And restart exim, of course)?

Greetings

Helge

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgoktcACgkQQbqlJmgq 5nA7CRAAkhA7mgSapi4zWlbtuhItSeSv1s0d3tcQ8Wo62zpBFrTXtwP/in62CmEG evg5w9FJXzbqOweC388GQds+T62QsY5yqmWYXnobC7j1805KfhcCoAz8eJ9lleb2 1+tEo1rw1csRVQTZ/hMt/6hiOc6/M70imciVx++StKbT7X+OI7HntLbzdyZWwxWg ARcX64OtKIFEgS2lj9D2iyhDduRDU3YXhEFKDHAYY+HcuOLHoAkE/ras/RcPjvW2 +rlJLWCRa38UcxsUuFG0um5OX/CGoaJnovnv2v73EZ3po0KOyRA6sUMsqzvWe2si hOOwAqsemnKfIzIulkdUkapuXFIXg41RWQzmGPy4aYjOX33p0ztk04pUZjD45Oz+ cX+lnxvQRI3sDdyDcdj/2J3Sx5YSZecuMGydIyaedn7qeGiSZ25QEXP/Xnv7Ca9w Um9KcCDAKR2OK3sEHofdg0rvJvTUMmJXryx4fnRduKemahGmzHYxVNIuwCJC7w5L 1sga3r7Om6Hl3zyXrmp7zy8MJmI6fDBzN0/6pXZ48fZJIx+l2+HrgCjZZzOJyhd0 hWZOk6sj84+XynHpSSAarmrhjv+Xmx23lJ+16kD

On Sat, May 17, 2025 at 01:44:57PM +0000, Helge Kreutzmann wrote:

In /etc/exim4 three files mention procmail:

exim4-config: /etc/exim4/conf.d/transport/30_exim4-config_procmail_pipe >exim4-config: /etc/exim4/conf.d/router/700_exim4-config_procmail >exim4-config: /etc/exim4/exim4.conf.template

But I never edited them directly, only via Debconf (probably when I
installed the machine.

If you don't use procmail, you should deinstall it. Exim can deliver by
itself.

I have had much fun with sending e-mail from a systemd unit as well, but
that systemd unit is rather verbose and limited. I ended up using a
helper program to deliver mail and not calling /usr/lib/sendmail any
more. See:

https://salsa.debian.org/debian/aide/-/blob/debian/latest/debian/aide-common.dailyaidecheck.service
https://salsa.debian.org/debian/aide/-/blob/debian/latest/debian/aide-common.dailyaidecheck.timer
https://salsa.debian.org/debian/aide/-/blob/debian/latest/debian/bin/dailyaidecheck

That was a pretty stiff amount of work.

My first guess is that the suid bit does not work when /usr/lib/sendmail
is invoked from the systemd unit, and running as logcheck exim can
indeed not do anything.

My second guess is that for some reason Helge's system indeed runs
logcheck's classical cron job AND the new systemd timer, and the systemd
timer version shows the issue in question. I'd go ahead and debug why logcheck's classical cron job doesn't get disabled on Helge's system.

Greetings
Marc

-- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402 Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Marc,
Am Sat, May 17, 2025 at 05:44:03PM +0200 schrieb Marc Haber:

On Sat, May 17, 2025 at 01:44:57PM +0000, Helge Kreutzmann wrote:

In /etc/exim4 three files mention procmail:

exim4-config: /etc/exim4/conf.d/transport/30_exim4-config_procmail_pipe exim4-config: /etc/exim4/conf.d/router/700_exim4-config_procmail exim4-config: /etc/exim4/exim4.conf.template

But I never edited them directly, only via Debconf (probably when I installed the machine.

If you don't use procmail, you should deinstall it. Exim can deliver by itself.

I use procmail on several machines, but right, on this one it is not
(much) used. I just wonder - is procmail incompatible with the updated logcheck?

I have had much fun with sending e-mail from a systemd unit as well, but
that systemd unit is rather verbose and limited. I ended up using a helper program to deliver mail and not calling /usr/lib/sendmail any more. See:

https://salsa.debian.org/debian/aide/-/blob/debian/latest/debian/aide-common.dailyaidecheck.service
https://salsa.debian.org/debian/aide/-/blob/debian/latest/debian/aide-common.dailyaidecheck.timer
https://salsa.debian.org/debian/aide/-/blob/debian/latest/debian/bin/dailyaidecheck

That was a pretty stiff amount of work.

My first guess is that the suid bit does not work when /usr/lib/sendmail is invoked from the systemd unit, and running as logcheck exim can indeed not
do anything.

My second guess is that for some reason Helge's system indeed runs
logcheck's classical cron job AND the new systemd timer, and the systemd timer version shows the issue in question. I'd go ahead and debug why logcheck's classical cron job doesn't get disabled on Helge's system.

The difference, btw. which I see before and after the update, is the
following:

Before the update I get mails with the subject:
Reboot: twentytwo.helgefjell.de 2025-05-16 15:54 +0200 System Events

After the reboot, now mails with this subject are sent; however, the
content is there (i.e. the filtered logs from the reboot are sent).

The cron.log says (before the update):
2025-04-14T00:02:01.739639+02:00 twentytwo CRON[11492]: (logcheck) CMD ( if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)

and after the update:
2025-05-17T18:02:01.470178+02:00 twentytwo CRON[110761]: (logcheck) CMD ( if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)

So the cron commands changed during the update.

file /run/systemd/system:
/run/systemd/system: directory

Should I revert this and look how it behaves?

Greetings

Helge
--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgoteUACgkQQbqlJmgq 5nBiTg/9F1rR5NDZKSkuLVLwMkrgWJwAVPggi5HrwFXmyiscowqBDLO3iKpdumte dPSthZm9S8L8G4sHKjyVtT5AgGXbQ0kWh7eVCmZLy8RkAu+FMHJKrRwWWCh83wKU hSLFs0uBQ8GgCbMQ7BOynx5Id/yVDO2sOmQDeJaR/Br9mJbiXFatge6VRn0viU// XRhr3TYMaxiZub7EOEpTw7LMv1MKsDW6tL6AM4tW7qIykUKTT9/WtoJ7WLken7pm xviFn54bihLsTqXfMJzc3DyKkq+LTvevSO0rRYvrcONn1Cp3LQgQCp9x66XFsjrH ssw2yenRX5Luk60IwrlbSxOUFlptOOnP0E9El4KNlgJD+72w8RBmG8weQFpgrBFG aRo8hVftXjm1q1C0P7wubPghpeehnOzmDXylSFitfpKOF5FgMHqo16JCq4GS9YgJ 57P224+2q80Be4vFa3bc0nN41zBRRB2Wxa8nZHz7yZGbgESpXMSSZ31Ll+anhCcO afUBnvP9CXIVNVRJ2YMjpLazkS32JVuy/NPkrEUm1WVm23g1QnO7Ixs+xcx100HO 5FHonyUakVrZwmQYdnsfI5F0DTsXFpJYSmHX2wA

On Sat, 17 May 2025 at 17:14, Helge Kreutzmann <debian@helgefjell.de> wrote:

Am Sat, May 17, 2025 at 05:44:03PM +0200 schrieb Marc Haber:

On Sat, May 17, 2025 at 01:44:57PM +0000, Helge Kreutzmann wrote:

In /etc/exim4 three files mention procmail:

exim4-config: /etc/exim4/conf.d/transport/30_exim4-config_procmail_pipe exim4-config: /etc/exim4/conf.d/router/700_exim4-config_procmail exim4-config: /etc/exim4/exim4.conf.template

But I never edited them directly, only via Debconf (probably when I installed the machine.

If you don't use procmail, you should deinstall it. Exim can deliver by itself.

I use procmail on several machines, but right, on this one it is not
(much) used. I just wonder - is procmail incompatible with the updated logcheck?

(it seems like this is the case, but it its not clear.)

To be clear: All logcheck is doing is sending an email, it doesnt make
any other assumptions on the mta so .... this should work.

There is a known 'incompatibility' between systemd and exim that both
upstreams have explicitly declined to address - but it's
not clear (to me anyway) why you are hitting this -- ive been using
systemd and logcheck (and several other local email-sending units) for
over
a year with hardening and (after much pain) it now works for me - i
get an email every single day from a shell script in a systemd unit.

but i dont use procmail so it may well be the difference.

I suspect we might need to revert the system timer for trixie because
there is clearly something more compleregualrlyx going on.

I have had much fun with sending e-mail from a systemd unit as well, but that systemd unit is rather verbose and limited. I ended up using a helper program to deliver mail and not calling /usr/lib/sendmail any more. See:

https://salsa.debian.org/debian/aide/-/blob/debian/latest/debian/aide-common.dailyaidecheck.service

this is interesting - i found i needed to have slightly different
settings. but in debian's logcheck unit there is no settings for any capabilities.

https://salsa.debian.org/debian/aide/-/blob/debian/latest/debian/bin/dailyaidecheck

i think this uses s-nail whereas logcheck uses mime-construct -- does
s-nail perhaps block until the mail is 'delivered'? or use smtp?

That was a pretty stiff amount of work.

recognise this!

My first guess is that the suid bit does not work when /usr/lib/sendmail is invoked from the systemd unit, and running as logcheck exim can indeed not do anything.

my understanding is that systemd assumes that all processes started by
a unit are part of that unit. so it wants
the mail sender (logcheck.server) to start a program to send data to
exim (which is in its own cgroup), and block until that is done.
whereas exim has slightly odd model where it starts a new process in
the background (using suid i guess) to immediately deliver the email
- systemd thinks this new process is part of the sending unit rather
than exim's unit and so has a tendency to kill it, when the "main"
process exits or stop it working in various ways.
Each upstream considers the other one to be wrong.

My second guess is that for some reason Helge's system indeed runs logcheck's classical cron job AND the new systemd timer, and the systemd timer version shows the issue in question. I'd go ahead and debug why logcheck's classical cron job doesn't get disabled on Helge's system.

that was my first thought, but i am no longer sure - i think that it is also possible that exim delivers the email but, before it can remove it
from the queue, systemd
tears down the logcheck unit, and so exim retries, and this makes a duplicate.

(i see regularly see this when adding hardening to the a systemd unit
that sends mail- but ive nver seen 2 emails, i
have only seen an email left in the queue, or frozen. and debian's
unit has no hardening.)

Before the update I get mails with the subject:
Reboot: twentytwo.helgefjell.de 2025-05-16 15:54 +0200 System Events

After the reboot, now mails with this subject are sent; however, the
content is there (i.e. the filtered logs from the reboot are sent).

you mean "no mails with this subject are sent"? this is expected -
logcheck's cron does a (pointless) extra run after a reboot -- the
_only_ difference is that it adds the word
"reboot" in the subject. this isnt done under systemd

The cron.log says (before the update):
2025-04-14T00:02:01.739639+02:00 twentytwo CRON[11492]: (logcheck) CMD ( if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)

and after the update:
2025-05-17T18:02:01.470178+02:00 twentytwo CRON[110761]: (logcheck) CMD ( if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)

So the cron commands changed during the update.

yes - the cron job is still running, but only if you are not booted
under systemd

Should I revert this and look how it behaves?

you could try - i predict you will get then get 3 emails: one from
cron, and the same 2 from the timer

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
Am Sat, May 17, 2025 at 06:58:56PM +0100 schrieb Richard Lewis:

On Sat, 17 May 2025 at 17:14, Helge Kreutzmann <debian@helgefjell.de> wrote:

The cron.log says (before the update):
2025-04-14T00:02:01.739639+02:00 twentytwo CRON[11492]: (logcheck) CMD ( if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)

and after the update:
2025-05-17T18:02:01.470178+02:00 twentytwo CRON[110761]: (logcheck) CMD ( if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)

So the cron commands changed during the update.

yes - the cron job is still running, but only if you are not booted
under systemd

Should I revert this and look how it behaves?

you could try - i predict you will get then get 3 emails: one from
cron, and the same 2 from the timer

I tried this now, and it is the opposite:

root@twentytwo:~# cat /etc/cron.d/logcheck
# /etc/cron.d/logcheck: crontab entries for the logcheck package
# These do nothing under systemd because the systemd timer will take precedence

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root

@reboot logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck -R; fi
#2 * * * * logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi
2 * * * * logcheck if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi


And now I get *one* e-mail again. The first had the exim error still,
but the second did not.

I'll report in ~ 30 minutes, if the error message has indeed vanished.

Greetings

Helge

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgpxmUACgkQQbqlJmgq 5nAaHg//eQRU43/m4KCw1HtYy8g0Mij1djrLkc/OBw3NNcZxHlFqMWYPVc5qrm5i y+JEz74Cgu9R5oFLixHleuve736g0gxn70eIQcqIOYsZwcfUJwPBxH8yCMvJGSAR YCgX4DJBKbkeZtplOUvSBJjpDFNvGIp7Jhpuy4lS+QPutP454md0rGjPASfnHz4n r910PMVhzStYDc5UHG41ScyaRIuUKKhC3mSRtTWWC1yoGEPZNul1pGst0wFyJ/4E ZXzgpU27Y153KHZzHaH/xN35VeX2LIXIKnLnpazKw6feFv5UtP4qKdi5ZIlBF2Zc yXz8mabEGV0eTUam19iEoYdhxY4Y/scy/cZzzZqKnegP/msTulcXgVNl4VVlqc/s 3lS+VU0nLADSAE8KU5NdNBuXZkvlfEXYSP1dDstqV+Ub3ZjIoEsQFYkOKWnZ8vyl qWYOMLPmb14JK+KEm3E9yxUBMt79ahq6HIqFp8nsRjoauYnYpMwz3qugV+xOrWkS UCKEwb7NvFbqaysDlkqpt05iI07P1hiKoTv9mXHFyg/XqABfBtlwnw+LdLZLsEbR klS8nJOR+XhYjXOPi2bnBNh41nL6SBMid1y1B43

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
Am Sun, May 18, 2025 at 01:18:57PM +0100 schrieb Richard Lewis:

On Sun, 18 May 2025, 12:37 Helge Kreutzmann, <debian@helgefjell.de> wrote:

root@twentytwo:~# cat /etc/cron.d/logcheck
# /etc/cron.d/logcheck: crontab entries for the logcheck package
# These do nothing under systemd because the systemd timer will take precedence

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root

@reboot logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck -R; fi
#2 * * * * logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi
2 * * * * logcheck if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi

And now I get *one* e-mail again. The first had the exim error still,
but the second did not.

makes sense -- there is a lag as then failed weite to paniclog on run N is reported by logcheck in run N+1

Also the 3rd e-mail no longer had the exim entry.

Looks to me as if this was the culprit.

is this with the systemd unit enabled or disabled?

I did not change anything beyond this.

root@twentytwo:~# systemctl status logcheck
◈ logcheck.service - logcheck
Loaded: loaded (/usr/lib/systemd/system/logcheck.service; static)
Active: inactive (dead) since Sun 2025-05-18 15:02:09 CEST; 11min ago
Invocation: deaadb792c564047a561772068245285
TriggeredBy: • logcheck.timer
Docs: man:logcheck(8)
Process: 2038900 ExecStart=/usr/sbin/logcheck (code=exited, status=0/SUCCESS)
Main PID: 2038900 (code=exited, status=0/SUCCESS)
Mem peak: 222.8M
CPU: 3.534s

Mai 18 15:02:01 twentytwo systemd[1]: Starting logcheck.service - logcheck... Mai 18 15:02:09 twentytwo systemd[1]: logcheck.service: Deactivated successfully.
Mai 18 15:02:09 twentytwo systemd[1]: Finished logcheck.service - logcheck.
Mai 18 15:02:09 twentytwo systemd[1]: logcheck.service: Consumed 3.534s CPU time, 222.8M memory peak.

Greetings

Helge
--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgp3TMACgkQQbqlJmgq 5nDrfg//aJV2QZEZOu+NrkiwBZJlxDxOJYOgxd0wBtPa23yRczXc4xgkPTqITXI7 jPBojLfLpB2eMuW1OJGdBv2HzUNF/JwDW/bPEVbzEQJiN9NGYJOusoW3w5zWCA4r 1nqgCnegYe3ciWVnVXlQ03+AMHx/KKku/YPCiR5eym/b2Xa66z8OezkIpn5kT0j9 aXueUQnlBoCq86hXFWZphOwEf8vCjh7ixsNrx48khewlOe1/BZgwwb//Rj+0F4nK N6Aea9Xyp4xaLxyMg93fDTEY3TQjlUrIG8/Vvj5XDZBiaTZGo+pgpekQ2IE99FaB SJSDOEk2Wv3M+DMQtRR7Czrxa4R3mDJvpEWot+7h/7E/ja/S681oJn0mhGhtm+EC zdqySuPPBR73PQHg0eU/HCf8npl24yZjR6TjWwOB1NkOgqWOvx0jNlb7diQWyMzg fG6/0zuOhKN5w1H+L9z+qL/ywZueRwbEQ/YiF4T29+88QA2otE4fCGNQXzUO9Tzx Wco4u0BsFDjDA1/R7i4o7XTNnkydM/O2l3jxRGMQQ9BRnMPbhTPbdkz/AX7iPZUJ E5vsKjiJMjAH5F01VpkWxm87fwwPOn6kKKuWbxX

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
Am Sun, May 18, 2025 at 02:28:16PM +0100 schrieb Richard Lewis:

On Sun, 18 May 2025, 14:14 Helge Kreutzmann, <debian@helgefjell.de> wrote:

Am Sun, May 18, 2025 at 01:18:57PM +0100 schrieb Richard Lewis:

On Sun, 18 May 2025, 12:37 Helge Kreutzmann, <debian@helgefjell.de>

wrote:

root@twentytwo:~# cat /etc/cron.d/logcheck
# /etc/cron.d/logcheck: crontab entries for the logcheck package
# These do nothing under systemd because the systemd timer will take precedence

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root

@reboot logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck -R; fi
#2 * * * * logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi
2 * * * * logcheck if [ -x /usr/sbin/logcheck ]; then nice

-n10

/usr/sbin/logcheck; fi

And now I get *one* e-mail again. The first had the exim error still, but the second did not.

makes sense -- there is a lag as then failed weite to paniclog on run N

is

reported by logcheck in run N+1

Also the 3rd e-mail no longer had the exim entry.

Looks to me as if this was the culprit.

is this with the systemd unit enabled or disabled?

I did not change anything beyond this.

root@twentytwo:~# systemctl status logcheck
◈ logcheck.service - logcheck
Loaded: loaded (/usr/lib/systemd/system/logcheck.service; static)
Active: inactive (dead) since Sun 2025-05-18 15:02:09 CEST; 11min ago
Invocation: deaadb792c564047a561772068245285
TriggeredBy: • logcheck.timer
Docs: man:logcheck(8)
Process: 2038900 ExecStart=/usr/sbin/logcheck (code=exited, status=0/SUCCESS)
Main PID: 2038900 (code=exited, status=0/SUCCESS)
Mem peak: 222.8M
CPU: 3.534s

Mai 18 15:02:01 twentytwo systemd[1]: Starting logcheck.service - logcheck...
Mai 18 15:02:09 twentytwo systemd[1]: logcheck.service: Deactivated successfully.
Mai 18 15:02:09 twentytwo systemd[1]: Finished logcheck.service - logcheck. Mai 18 15:02:09 twentytwo systemd[1]: logcheck.service: Consumed 3.534s
CPU time, 222.8M memory peak.

so you've now got

- cron is running logcheck
- systemd is also running logcheck

only one of them sends an email
no other errors
no other messages in the mailq?

I see no errors, mailq returns without output and with exit code 0,
the exim logs are not showing any errors.

i can only guess that the email comes from cron, and system's email is now being silently lost.

Could be.

can you check this -- if you add a -R to the cron.d line so it is

... nice -n10 /usr/sbin/logcheck -R; ....

then any emails from cron will have "Reboot" in the subject, and any email from systemd will not, that would be helpful.

(youll presumably now only get a logcheck email if there is something in
the log to report, i usually do "logger test" to make sure that happens)

Made the change and will report.

And don't worry about missing logs, I think I have a few dozen bug
reports open, requesting to add logcheck files, bút almost all
maintainers ignore this and I'm always lagging a bit filtering the
latest messages (and expected errors).

Greetings

Helge


--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgp4g0ACgkQQbqlJmgq 5nC1sg/9FjL9cSBXVyzIF9q2jaKDPA/Y7NKge3cu0JGPE+lZoUUfT7ubkC0/6l6d 9WKAq5QUnrvT4J2ElP7hGdMnCXKlpFp3lqvlSuLByNAUcxrMyRPQ2yHkl8DXzquA LOwEuPRefOjGBfuTn2U8XfNksrFzfrRRG3iPQKHUS7zmGDLOCLPjx51CrsCU9eo9 mMwB/MBmkC2zzxXUokpXHw5FbQb4+TMJ6IKdSQ4emx3bLFgtdV3ro3AwNpcyM/1E JiGMWcMnm15r4oDIftu5j8u75sun/ukL6788vRrQLtGgHWKpagWpIwJ5Dn7MIvI+ RTVu2qDra34NJbzL60qonlp7yCuQ9tpVyN/n2kwrSbXpVXxdSNJgIdqunFUPhiJn uqthm9fZcDNO0QrhBsCOEt7pwte+TOW4FBQUt8y/l847COAuTzbWTnp7DnzYNaDk uBRt1clXgvAaOA8xRkL0aX0S6VsQF5ff7YEgCvvAUcgJcIhoFjf1ZrKpNl3oqelm RFlZQCKQ+4xjo6K+OT/uyZd9PQDZcjXOaaY/tw0MgETk/GGJtsqXFJHn1BRLarye uXxsIchPLdo/yHQWYY9GaBLS04PaI8Q8YoaDaNY

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
Am Sun, May 18, 2025 at 02:40:04PM +0100 schrieb Richard Lewis:

On Sun, 18 May 2025, 14:28 Richard Lewis, < richard.lewis.debian@googlemail.com> wrote:

On Sun, 18 May 2025, 14:14 Helge Kreutzmann, <debian@helgefjell.de> wrote:

Am Sun, May 18, 2025 at 01:18:57PM +0100 schrieb Richard Lewis:

On Sun, 18 May 2025, 12:37 Helge Kreutzmann, <debian@helgefjell.de>

wrote:

so you've now got

- cron is running logcheck
- systemd is also running logcheck

only one of them sends an email
no other errors
no other messages in the mailq?

i can only guess that the email comes from cron, and system's email is now being silently lost.

can you check this -- if you add a -R to the cron.d line so it is

... nice -n10 /usr/sbin/logcheck -R; ....

then any emails from cron will have "Reboot" in the subject, and any email from systemd will not, that would be helpful.

(youll presumably now only get a logcheck email if there is something in the log to report, i usually do "logger test" to make sure that happens)

stuud me -- you wont get 2 emails because whoever runs second may not find any new messages to report. and in fact if both cron and systemd are
running at the same time onenof them should fail as it cant take the lock.
so you cant ever get duplicate reports from having cron and systemd
running, so that was never the cause.

Yes, now the subject is Reboot:

I dont't get any e-mails without the Reboot form this logcheck
anymore.

So this would mean (only) cron is running, correct?

Greetings

Helge

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgqCU0ACgkQQbqlJmgq 5nAZCg/+KhvlNviCRvMAjjr65O/t4azXExq3rT+VZzJq0opb30zkLxleHew1fLW/ HQt65ER46nCtize9VppwtZxID4FoVJCs8Ob1vHjFPDHKOyKkDaGJsFJN2B655fLf sgMweoJcUpXZs5crLKMwB/t9C/3ENJ3Au7kMmCu+JylKWPbqcL0RUOMdZ/qm9M8Y WQP09oDno50XluZIT1cOeusjZfsbLuBtAdGTHJMTwSrxw+3OAV8Y/fS5i8HHKkFM 1i/G7Nm0rO4C+Q6q4mkZSYjxoW6Ea77oJndcrTIxTm1OiX+YI9lv9IBtn25rfHgP 1z9FL13E81bKWMjxXG0k/6Ed+zlcoL0e5ZCkCVUnktqe8HMV3B785f1AIh0neVgB KlEbvUiZ4zKXTzcs3nqOTn+/TFaf3hqnoOHPT/Li+bIGR8R/+bHcHz6f3qXWS/CI MhT/BaiXnMKWaAGKhFUXph8W7ZSmctF8kuYJXzB/OQT4xmQs2y6Yp9G5zD4DluKS g+0RSyPhv1fWG0ak+lUHIg/HPywtfiQ+zKAiPr0LGotTjZjWFUOqQZN/pZhfc0w4 yjFXliVpu4W+YODrUywqq4EQ9KglAVrKx7b3z4O

On Sat, May 17, 2025 at 04:14:34PM +0000, Helge Kreutzmann wrote:

I use procmail on several machines, but right, on this one it is not
(much) used. I just wonder - is procmail incompatible with the updated >logcheck?

No, it's just to make exim's processing easier.

Before the update I get mails with the subject:
Reboot: twentytwo.helgefjell.de 2025-05-16 15:54 +0200 System Events

After the reboot, now mails with this subject are sent; however, the
content is there (i.e. the filtered logs from the reboot are sent).

The cron.log says (before the update):
2025-04-14T00:02:01.739639+02:00 twentytwo CRON[11492]: (logcheck) CMD ( if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)

and after the update:
2025-05-17T18:02:01.470178+02:00 twentytwo CRON[110761]: (logcheck) CMD ( if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)

I guess one of the messages come from the old cron job which might not
be disabled properly, and the other one from the new systemd timer.

Greetings
Marc

-- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402 Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Marc,
Am Sun, May 18, 2025 at 06:30:25PM +0200 schrieb Marc Haber:

On Sat, May 17, 2025 at 04:14:34PM +0000, Helge Kreutzmann wrote:

Before the update I get mails with the subject:
Reboot: twentytwo.helgefjell.de 2025-05-16 15:54 +0200 System Events

After the reboot, now mails with this subject are sent; however, the content is there (i.e. the filtered logs from the reboot are sent).

The cron.log says (before the update):
2025-04-14T00:02:01.739639+02:00 twentytwo CRON[11492]: (logcheck) CMD ( if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)

and after the update:
2025-05-17T18:02:01.470178+02:00 twentytwo CRON[110761]: (logcheck) CMD ( if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi)

I guess one of the messages come from the old cron job which might not be disabled properly, and the other one from the new systemd timer.

Per advice of Richard, I just disabled cron, so let's see if the
systemd timer is sending anything.

Greetings

Helge

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgqEwAACgkQQbqlJmgq 5nBYbQ//aocgOljXWDjr34WJGbZneeyDJMPvTu1dDMH0aKLNhK6FrL9ANyF/p02i XuIPgvwoHyJyY/ofgxfaJCxF3UlFiaOU3gpOM0498y7lzETxTXvL8AqFkicg9+Uy 27GmDXRJ+O5aUDo3Xn5C19kfQywZ4PDWt4p5xsKU7HkCTVfJYikJSg8U921Cz8Tp OUrT990NOtHMUfxmIhneqEuJQ3R36wTJu+S0MEc79hpWDmRRxH4j1kcaXVGLs8sy h796QnrbmeH1pSoW0jXCVrMisu5AfDsn8KfIGdgLFnNmXHbTqE5fnftCQCLn/Zw6 RLrPHnvrv8a87MxCnfF2yvSye95Uzc8e5eDJK8OJG47faxDG+mt+V05UsNpzG3wa CQFKBqmLlidr36hXSKto4EUg0C6Sid9QeA+uIWYk9eaXOHDYc7od/Hc/raFFgW4G LIZTr3Ib1n7/Z1yuSjq/jDFC/+Y3XFNXDJVS2wUOLUNrOlm+0Z4/KK3cZe4xEIlz 1fRlfgAv8vq7Qf+xJLEsTF/WMUdYH+m9wS9+sMFx7xh1CUFKJAT/W3+EHkA6EGlo Q5okZO93x9XIc0aNPmAEe4cW+4dtA6RAStxzz+g

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
Am Sun, May 18, 2025 at 07:12:15PM +0100 schrieb Richard Lewis:

On Sun, 18 May 2025, 18:02 Helge Kreutzmann, <debian@helgefjell.de> wrote:

Hello Richard,
Am Sun, May 18, 2025 at 05:41:49PM +0100 schrieb Richard Lewis:

On Sun, 18 May 2025, 17:22 Helge Kreutzmann, <debian@helgefjell.de>

wrote:

Yes, now the subject is Reboot:

I dont't get any e-mails without the Reboot form this logcheck
anymore.

So this would mean (only) cron is running, correct?

yes, i think so. it would help to check that if you comment out the cron line nothing different happens, ie you would then get no mails at all?

I just switched to:
@reboot logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck -R; fi
#2 * * * * logcheck if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi
#2 * * * * logcheck if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck -R; fi

Now I'm getting two mails again, one at 2/3 minutes past the hour, one
at 16 minutes past the hour (in the two samples I received).

I'll return to your other question in a minute.

Greetings

Helge

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgqLAAACgkQQbqlJmgq 5nDFqxAAq5shXofwIywIGCqDjJBGS8HI/AjLPZcQh2bOXwUYQqnlsR1AK1/wtvWb d+nC2wtxm8pkqppW1HqyuVib0gtrxKIqg5OaPmKTa6bU5qWEtQgrPzLvTJaKBN8P zKrxHjJddc223+Uc3q5wXTSyoEau4254Hl31gDjYaldU8BrHs2SKPw/Ev4RlbO1X TOEfmJpuhVHBX2hBSAzlHK525CaB4PeSbRwojM54jn9zGhEQrzqUMYJiPH+sR7Xf /Rj2bRsoxCiiN5+mc+Cji3dVb1vbgL0OYvf+E8Wghxow6czFOQ7GSLUOt2RDZnqO ffTifsmsG1n4X/gDEcM8JNrmWF1CVT0TDlEpL89ryokEeS3yxq6mngRTy5uJtPeu Erzfl4DGHXGMJbeIINzRA9I/15pUWJNmITNdvBFCxvuSJDwwaKdmxN1LsSPp3Iom 13BZep1SUYiYaQGnVR1J4WzU1aeW3X9c54Jgo630S1cIBYozW3ZeKhBnmt4Q/AaD ZHizIae1EkrqXTv6zT/VUI1PcU8Is9Jc+88pxygIXkhqHspeozsuPJdGDdDIjN56 wSFSuEGrlXrbaINrjdojUDqLqHXTHbpPBSPGm40

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
Am Sun, May 18, 2025 at 07:12:15PM +0100 schrieb Richard Lewis:

i think what i need to know is - how do i configure exim to match your set up. .probably thay is just what procmail package to install, and any
settings for that? (i know nothing about procmail)

im starting in a systemd-nspawn container and am not seeing the issue yet)

I cannot tell you how I installed it initially. I started with Debian
around 2000, and the systems evolved, i.e. when installing a new
machine I usually copied over important configuration files.

I noticed that exim contains some rules regarding procmail, but I'm
sure that I did not touch them. I have no idea how to configure exim
except by Debconf.

The procmail recipie which is in place is neglible, so I just
deinstalled procmail.

Let's see the next run …

Greetings

Helge

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgqLo4ACgkQQbqlJmgq 5nB9LQ/9Gi/bsTjj+ZEOHJEwISrxHTT8W763C0s8xXQMpr8J2IR1g/TmGRnwMy4n j59FnRzBZORrkJVhuZc71b3pJphGdya9BOTreQF9ufhS9mZtPJ7CbWCgRqRerFdC U1GWG4Gxayvb6mcv0b03cJGiTYLXkIH6lroAguvuAoi1pHJ0CEotUcjnWKIb0D+6 ZfnMN7TWKsxBj/F8ogp3SjzAMUtM75+jhCjrggbxAQrECULT7HZSAHZ+uFMga74s RaztAS6cTVxyw+ZOBpjkfg4FuV3LsbmNf4iqNOLV3y4n3PEn6zOv3bE1dKOHRsBH 0ml4Hw4a/YE2iIxhyEDm6KiV0OD67MztvT/8GBT/hdr3+wjsNzp1cu2tSbXhVB3M Hb6ik2AkPD6UY1dIxQgBoqCDNjbHsBI1AlThPqokml162VMzyYUKGNTUyxIZdT0n XTOqnjYgbRcLDlPa1HAzZTFegd0QX42JoAiSXZUCBwB6NfAkM2HALX01ZQIVSK8c yMLxoMN2Va5U/0hHNeXyVBpIi5GB6lslBDYzAsVlaJC0pnIbRvDzIzWSdr9HYRCa hn2Px26ICeLpU/h7I4/RF7ynBcJKQBTG19mCuqV

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages.

Hello Richard,
Am Sun, May 18, 2025 at 07:01:34PM +0000 schrieb Helge Kreutzmann:

Hello Richard,
Am Sun, May 18, 2025 at 07:12:15PM +0100 schrieb Richard Lewis:

i think what i need to know is - how do i configure exim to match your set up. .probably thay is just what procmail package to install, and any settings for that? (i know nothing about procmail)

im starting in a systemd-nspawn container and am not seeing the issue yet)

I cannot tell you how I installed it initially. I started with Debian
around 2000, and the systems evolved, i.e. when installing a new
machine I usually copied over important configuration files.

I noticed that exim contains some rules regarding procmail, but I'm
sure that I did not touch them. I have no idea how to configure exim
except by Debconf.

The procmail recipie which is in place is neglible, so I just
deinstalled procmail.

Let's see the next run …

Ok, some mails no longer get properly sorted, but on this machine this
is tolerable. But procmail is gone now.

Now I get only single e-mails (with all the changes in the settings
shown earlier).

However, my server extensivly uses procmail (and logcheck), so this
combo should really work. I have no idea how we can debug this in the
hard freeze now. (My server is running stable, and does so for a
reason).

From my side, I'm now back to work, so before Friday I won't have much
time for debugging.

I would suggest to install a machine with local exim (per debconf) and
some simple procmail rules, maybe just installing procmail is
sufficient, I don't know.

And maybe for postponing the changes in 1.4.4 for the next development
cycle?

Greetings

Helge

--
Dr. Helge Kreutzmann debian@helgefjell.de
Dipl.-Phys. http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
Help keep free software "libre": http://www.ffii.de/

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmgqRKIACgkQQbqlJmgq 5nAEXRAAmVTufN3DDYlxK4wobdiALRJLIFUxWtFow/AQsmdmAqatQUJuvlVO1zUg iS14ICjTbq0nCLmOasxjlKVDJhY4FndTB1zTGSqfmVeSRRveCNd85anrrEmckDPI uN+Zhl41dqpMM0StPjf/0HzNKy58iKNTy5OA0RPUKDGRQC1e2DEOlwSDOVBcFuO8 HKYzNXmcvU15F1HzgbTQf9GV3aMmToL+MPJBYrrBZ3p49In4Ya8Hn8QCRorC77G2 NnGXKZlKMAITz74LRH8XB+humV5GvYruqK2YEX1/9fXDCd/vQ6gpGD3BD4NRC3P/ iJnuynSdk7u+xOgGbEzP3CaGWY4e6wmOrEigj6BHjGjd/csGa9tAR8d8gcV6nDFR LYfgxbX1vQyJcgyE5ANS7N6hxp3TOT2LWXzZ1z9OP6QmO1mnrgGpQz4aHAFpHnME N8P0YqebkAJRwVpv5+9Puzq1ZfVlfene8Vye+3tCub2JPcBPuxFsHMXDuoWYJctX kMnmM7Viwd94rzmCjOhG2ceogD/sDsJ5VwxETkDd/dJiG+bZqGTDPMvc93vPFEfU 2j4a7/ohGCynADmT7JSqh54L1CSkpZ6r0UMw2PC