Some users cannot see the log messages and get the following message in latest Junos version:

test@qfx> show log messages

error: could not open 'messages'
 

Junos syslog privilege change after applying the fix of PR1702241. A user other than the 'root' user or a user with the 'maintenance' category permitted will not be able to view log files and get the following message:

test@qfx> show log messages

error: could not open 'messages'

The 'test' user does not have the 'maintenance' category permitted.

test@qfx> show cli authorization

Current user: 'test' class 'Read-Only'

Permissions:

   access     -- Can view access configuration

   interface  -- Can view interface configuration

   network    -- Can access the network

   routing    -- Can view routing configuration

   view       -- Can view current values and statistics

   view-configuration-- Can view all configuration (not including secrets)

Individual command authorization:

   Allow regular expression: none

   Deny regular expression: none

   Allow configuration regular expression: none

   Deny configuration regular expression: none

According to the Juniper documentation Junos OS Default System Log Settings the only users who can view the logs are 'root' and users with the Junos OS maintenance permission.
Latest Junos version have been changed to allow only root user or maintenance permission users to view the log files. Other permission categories will not be able to see them.
As in the output shown earlier, the user 'test' doesn't have permission from the 'maintenance' category, which is why it gets the message "could not open 'messages'."

If you want to enable other users to read the log files, you can consider one of the following 4 options:

Option 1:
To allow all user to read the log files, you can configure 'world-readable' knob under 'system syslog' hierarchy:
[edit system syslog]
archive {
   world-readable;
}

For example:
root@qfx# show | compare 
 
[edit system syslog]
+    archive world-readable;
 
test1@qfx> show cli authorization 
Current user: 'test1     ' class 'Read_Only'
Permissions:
    access      -- Can view access configuration
    interface   -- Can view interface configuration
    network     -- Can access the network
    routing     -- Can view routing configuration
    view        -- Can view current values and statistics
    view-configuration-- Can view all configuration (not including secrets)
Individual command authorization:
    Allow regular expression: none
    Deny regular expression: none
    Allow configuration regular expression: none
    Deny configuration regular expression: none
       
test1@qfx> show log messages   
Sep  6 17:00:00 qfx newsyslog[16899]: logfile turned over due to size>256K
Sep  6 17:00:36  qfx alarmd[8730]: Alarm cleared: License id=0, color=YELLOW, class=CHASSIS, reason=BGP Routing Protocol(47) usage requires a license
Sep  6 17:00:36  qfx craftd[8731]: Receive FX craftd clear alarm message: color: Minor class: 50 slot: 126


Option 2:
If you only want to allow specific files to be read, you can configure the 'world-readable' knob under the 'file <filename>' hierarchy for each file you want to allow reading:

file filename {
    archive {
        world-readable;
    }
}

For example: 

root@qfx# show | compare    
[edit system syslog file messages]
+     archive world-readable;

test1@isn-se1-montreal19> show cli authorization 
Current user: 'test1       ' class 'Read_Only'
Permissions:
    access      -- Can view access configuration
    interface   -- Can view interface configuration
    network     -- Can access the network
    routing     -- Can view routing configuration
    view        -- Can view current values and statistics
    view-configuration-- Can view all configuration (not including secrets)
Individual command authorization:
    Allow regular expression: none
    Deny regular expression: none
    Allow configuration regular expression: none
    Deny configuration regular expression: none

test1@qfx> show log messages    
Sep  8 20:30:00 isn-se1-montreal19 newsyslog[15356]: logfile turned over due to size>256K
Sep  8 20:30:05  isn-se1-montreal19 alarmd[8741]: Alarm cleared: License id=0, color=YELLOW, class=CHASSIS, reason=BGP Routing Protocol(47) usage requires a license

Other files, such as 'interactive-commands,' cannot be viewed by the 'test1' user.

test1@qfx> show log interactive-commands 
error: could not open 'interactive-commands'

Option 3:
The option1 and option2 can only add 'r' flag to the uncompressed files that being configured under [system syslog files]. However, compressed files like messages.0.gz and other files like chassisd still can't be read by these 2 options.  We can use the following cli to add 'r' flag to the particular log file that you need:
<<<
set system syslog archive world-readable
set system syslog file messages* archive world-readable
set system syslog file chassis* archive world-readable'
…
…
<<<

The flag can't be removed if the cli is deleted. We need to go to shell to recover the flag. 

start shell user root
cd /var/log
chmod -R 640 * 

Option 4: 
You can add the maintenance permission to the user class.

For example:

root@qfx> set system login class Read_Only permissions maintenance

Reviewing the configuration:
root@qfx> show configuration | display set | match "class Read_Only" 
set system login class Read_Only permissions access
set system login class Read_Only permissions interface
set system login class Read_Only permissions maintenance
set system login class Read_Only permissions network
set system login class Read_Only permissions routing
set system login class Read_Only permissions view
set system login class Read_Only permissions view-configuration
set system login user test class Read_Only

Now, logging in with the 'test' user, which belongs to the 'Read_Only' class, and confirming its authorization.

test@qfx> show cli authorization 
Current user: 'test        ' class 'Read_Only'
Permissions:
    access      -- Can view access configuration
    interface   -- Can view interface configuration
    maintenance -- Can become the super-user <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
    network     -- Can access the network
    routing     -- Can view routing configuration
    view        -- Can view current values and statistics
    view-configuration-- Can view all configuration (not including secrets)
Individual command authorization:
    Allow regular expression: none
    Deny regular expression: none
    Allow configuration regular expression: none
    Deny configuration regular expression: none

The user 'test' is able to view log files.
test@qfx> show log messages   
Sep  6 17:00:00 qfx newsyslog[16899]: logfile turned over due to size>256K
Sep  6 17:00:36  qfx alarmd[8730]: Alarm cleared: License id=0, color=YELLOW, class=CHASSIS, reason=BGP Routing Protocol(47) usage requires a license

The maintenance class permission can perform system maintenance, including starting a local shell on the device and becoming the superuser in the shell (using the su root command) and halting and rebooting the device (using the request system commands).
If you are using maintenance permission and you do not want to allow the users execute commands to access to shell or reboot the device, you can deny those specific commands for the class as shown below:

root@qfx> set system login class Read_Only deny-commands "(start shell)|(request system)"

Reviewing the configuration:
root@qfx> show configuration | display set | match "class Read_Only" 
set system login class Read_Only permissions access
set system login class Read_Only permissions interface
set system login class Read_Only permissions maintenance
set system login class Read_Only permissions network
set system login class Read_Only permissions routing
set system login class Read_Only permissions view
set system login class Read_Only permissions view-configuration
set system login class Read_Only deny-commands "(start shell)|(request system)"
set system login user test class Read_Only

Now, logging in with the 'test' user, which belongs to the 'Read_Only' class, and confirming their authorization.
test@qfx> show cli authorization 
Current user: 'test        ' class 'Read_Only'
Permissions:
    access      -- Can view access configuration
    interface   -- Can view interface configuration
    maintenance -- Can become the super-user
    network     -- Can access the network
    routing     -- Can view routing configuration
    view        -- Can view current values and statistics
    view-configuration-- Can view all configuration (not including secrets)
Individual command authorization:
    Allow regular expression: none
    Deny regular expression: (start shell)|(request system)  <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
    Allow configuration regular expression: none
    Deny configuration regular expression: none

The user 'test' is able to view log files.
test@qfx> show log messages   
Sep  6 17:00:00 qfx newsyslog[16899]: logfile turned over due to size>256K
Sep  6 17:00:36  qfx alarmd[8730]: Alarm cleared: License id=0, color=YELLOW, class=CHASSIS, reason=BGP Routing Protocol(47) usage requires a license
Sep  6 17:00:36  qfx craftd[8731]: Receive FX craftd clear alarm message: color: Minor class: 50 slot: 126

The user 'test' cannot access the shell or reboot the device:
test@qfx> start sh
                               ^
syntax error, expecting <command>.
 
test@qfx> request sy   
                                 ^
syntax error, expecting <command>.
                                    ^

https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/system-logging.html#id-junos-os-default-system-log-settings