Currently app-admin/logsentry-1.1.1 user the temporary directory /etc/logcheck/tmp directory to prepare logsentry results, requiring, thus, a writable /etc. It should probably move to something like /var/tmp/logcheck.
Created attachment 261002 [details] Modified ebuild to move temp dir to /var/tmp/logcheck /var/tmp/logcheck seems like a good choice since /var/tmp is not supposed to be a tmpfs and should be writable. Attached is a modified ebuild that sets it up as /var/tmp/logcheck.
Added to portage as app-admin/logsentry-1.1.1-r1.