<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Also would like to throw out that I am open to using strace or some other debug hook program to figure out the cause here if that would help better, just would like a pointer as to how I would go about using it to identify dropped logs. I don’t believe
running syslog-ng with the debug setting on its own indicates if a logged event has been dropped or not (but I suppose it could indicate that the log never made its way over). </div>
<div> </div>
<div>Thanks,</div>
<div>Andrew</div>
<div> </div>
<div>From: Andrew Bell </div>
<div>Sent: Wednesday, April 15, 2015 11:55 AM</div>
<div>To: syslog-ng@lists.balabit.hu</div>
<div>Subject: Issues running syslog-ng-ctl program locally to determine logging issues</div>
<div> </div>
<div>Hello,</div>
<div> </div>
<div>Wondering if someone can help me with an issue that I am currently having. I am running syslog-ng as a local non-root user (I have it installed to a local instance under my home directory) and am trying to use the syslog-ng-ctl program in order to diagnose
why certain log files are not passing through syslog-ng to their log destination (trying to rule out if it is a problem with the location where the logs originate OR if there is an issue with the syslog-ng setup and it is dropping or otherwise failing to forward
those incoming logs). However, when I try to run syslog-ng-ctl under my local account I get the following error, where it appears to reference a control socket that is located in a directory that is owned and operated by the root account (I should note that
I am unable to sudo as root with my setup on the system). </div>
<div> </div>
<div>/home/abell/syslog-ng-install/opt/syslog-ng/sbin$ ./syslog-ng-ctl verbose</div>
<div>Error connecting control socket, socket='/opt/syslog-ng/var/run/syslog-ng.ctl', error='No such file or directory'</div>
<div>This type of error above is also appearing when I run syslog-ng program itself with the debug (‘-d –v’) options set</div>
<div>Error opening control socket, bind() failed; socket='/opt/syslog-ng/var/run/syslog-ng.ctl', error='No such file or directory (2)'</div>
<div> </div>
<div>I did some searching online and did find some manuals on syslog-ng-ctl that said I could specify a different directory where the control socket resides to one that isn’t in the root directory using the “-c” flag. This mailing list post also mentioned that
running a local instance of syslog-ng-ctl should automatically create a local instance of the control socket file located in the /var directory where the local instance resides (so in my case, I imagine it would be /home/abell/syslog-ng-install/var ???). Here’s
the reference link -> <a href="https://lists.balabit.hu/pipermail/syslog-ng/2009-June/013027.html">
https://lists.balabit.hu/pipermail/syslog-ng/2009-June/013027.html</a> - there weren’t any next messages to this thread so it is difficult to tell if this solution worked for the original author here or not…</div>
<div> </div>
<div>So I created that “/var” directory as he suggested but I still don’t see the .ctl file created when I go to stop and restart syslog-ng … and so I don’t really have anything to specify for the “-c” option as an alternative. I tried touching the control
socket file in that directory as a zero byte file, but still nothing</div>
<div> </div>
<div>/home/abell/syslog-ng-install/opt/syslog-ng/var$ touch syslog-ng.ctl</div>
<div>/home/abell/syslog-ng-install/opt/syslog-ng/var$ cd ..</div>
<div>/home/abell/syslog-ng-install/opt/syslog-ng$ cd sbin</div>
<div>/home/abell/syslog-ng-install/opt/syslog-ng/sbin$ ./syslog-ng-ctl verbose --set=on -c /home/abell/syslog-ng-install/opt/syslog-ng/var/syslog-ng.ctl</div>
<div>Error connecting control socket, socket='/home/abell/syslog-ng-install/opt/syslog-ng/var/syslog-ng.ctl', error='Connection refused'</div>
<div> </div>
<div>Any ideas as to how I can get this control socket file created on my local syslog-ng – or if I can tell syslog-ng itself to specify spinning up the control socket file itself in a different location than the root one? I’d really like to be able to use
this tool to figure out what is going on with my syslog-ng setup. Let me know if there’s any other details or information that I can provide. </div>
<div>Thanks,</div>
<div>Andrew</div>
<div> </div>
</span></font>
</body>
</html>