logfetch.status on Darwin clients

[Dominique Frise]

Hi,

On Darwin clients logfetch.status never get updated (shows 0 bytes) and thus 
alert messages never get expired:

-----clientdata------
[msgs:/var/log/system.log]
Apr 28 03:15:01 zelda2 cp: error processing extended attributes: Operation not 
permitted
Apr 28 03:15:01 zelda2 cp: error processing extended attributes: Operation not 
permitted
Apr 28 03:15:01 zelda2 cp: error processing extended attributes: Operation not 
permitted
Apr 28 06:17:13 zelda2 sudo:       bb : TTY=unknown ; PWD=/Users/bb ; USER=root 
; COMMAND=/sbin/shutdown -H
Apr 28 08:13:21 zelda2 su: bb to root on /dev/ttyp1
Apr 28 08:14:02 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/Users/bb ; USER=root ; 
COMMAND=/sbin/SystemStarter stop BB
Apr 28 08:15:36 zelda2 su: bb to root on /dev/ttyp1
Apr 28 08:16:08 zelda2 sudo:       bb : TTY=ttyp1 ; 
PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter 
stop BB
Apr 28 08:16:08 zelda2 SystemStarter[3131]: "/Library/StartupItems/BB/BB" 
failed security check: not owned by UID 0
Apr 28 08:16:08 zelda2 SystemStarter[3131]: "/Library/StartupItems/BB/BB" 
failed security check: not owned by GID 0
Apr 28 08:16:08 zelda2 SystemStarter[3131]: Unknown service: BB
Apr 28 08:16:12 zelda2 sudo:       bb : TTY=ttyp1 ; 
PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter 
stop BB
Apr 28 08:16:12 zelda2 SystemStarter[3132]: "/Library/StartupItems/BB/BB" 
failed security check: not owned by UID 0
Apr 28 08:16:12 zelda2 SystemStarter[3132]: "/Library/StartupItems/BB/BB" 
failed security check: not owned by GID 0
Apr 28 08:16:12 zelda2 SystemStarter[3132]: Unknown service: BB
Apr 28 08:16:18 zelda2 sudo:       bb : TTY=ttyp1 ; 
PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter 
start BB
Apr 28 08:16:18 zelda2 SystemStarter[3133]: "/Library/StartupItems/BB/BB" 
failed security check: not owned by UID 0
Apr 28 08:16:18 zelda2 SystemStarter[3133]: "/Library/StartupItems/BB/BB" 
failed security check: not owned by GID 0
Apr 28 08:16:18 zelda2 SystemStarter[3133]: Unknown service: BB
Apr 28 08:16:37 zelda2 sudo:       bb : TTY=ttyp1 ; 
PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter -d 
start BB
Apr 28 08:16:37 zelda2 SystemStarter[3137]: "/Library/StartupItems/BB/BB" 
failed security check: not owned by UID 0
Apr 28 08:16:37 zelda2 SystemStarter[3137]: "/Library/StartupItems/BB/BB" 
failed security check: not owned by GID 0
Apr 28 08:16:37 zelda2 SystemStarter[3137]: Unknown service: BB
Apr 28 08:20:49 zelda2 su: pam_authenticate: Authentication failure
Apr 28 08:20:55 zelda2 su: bb to root on /dev/ttyp1
Apr 28 08:21:27 zelda2 SystemStarter[3154]: "/Library/StartupItems/BB/BB" 
failed security check: not owned by UID 0
Apr 28 08:21:27 zelda2 SystemStarter[3154]: "/Library/StartupItems/BB/BB" 
failed security check: not owned by GID 0
Apr 28 08:21:27 zelda2 SystemStarter[3154]: Unknown service: BB
Apr 28 08:22:56 zelda2 sudo:       bb : TTY=ttyp1 ; 
PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter 
start BB
Apr 28 08:24:12 zelda2 sudo:       bb : TTY=ttyp1 ; 
PWD=/soft/pub/BB/hobbit/client/tmp ; USER=root ; COMMAND=/sbin/SystemStarter 
restart BB
Apr 28 08:57:20 zelda2 su: bb to root on /dev/ttyp1

[logfile:/var/log/system.log]
type:100000 (file)
mode:640 (-rw-r-----)
linkcount:1
owner:0 (root)
group:80 (admin)
size:3
clock:1146219697 (2006/04/28-12:21:37)
atime:1146219697 (2006/04/28-12:21:37)
ctime:1146207446 (2006/04/28-08:57:26)
mtime:1146207446 (2006/04/28-08:57:26)
------------------




zelda:/soft/pub/BB/hobbit/client/tmp bb$ ls -la
total 80
drwxr-xr-x  5 bb  ci    170 28 Apr 12:28 .
drwxr-xr-x  9 bb  ci    306 27 Apr 09:10 ..
-rw-r--r--  1 bb  ci     63 28 Apr 12:28 logfetch.cfg
-rw-r--r--  1 bb  ci     34 28 Apr 12:28 logfetch.status
-rw-r--r--  1 bb  ci  29495 28 Apr 12:28 msg.txt


zelda:/soft/pub/BB/hobbit/client/tmp bb$ cat logfetch.status
/var/log/system.log:0:0:0:0:0:0:0


zelda:/soft/pub/BB/hobbit/client/logs bb$ wc /var/log/system.log
      349    2847   47437 /var/log/system.log


hobbitclient.log is empty.

Where could be the problem?

Dominique
UNIL - University of Lausanne