<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Helvetica, Arial, sans-serif">Here it is nothing special
everything is active from syslog-ng<br>
<br>
[2016-05-12T06:58:31.428821] Compiling #unnamed sequence [log] at
[/etc/syslog-ng/syslog-ng.conf:97:7]<br>
[2016-05-12T06:58:31.428829] Compiling s_sys reference [source]
at [/etc/syslog-ng/syslog-ng.conf:97:7]<br>
[2016-05-12T06:58:31.428838] Compiling d_mongodb reference
[destination] at [/etc/syslog-ng/syslog-ng.conf:97:22]<br>
[2016-05-12T06:58:31.429227] Seeking the journal to the last
cursor position;
cursor='s=45e493f939fe45439dc7263dbac327e7;i=18d5;b=a99860976f4b493db69999b0b65079a8;m=1fe68c36f;t=532a30982aa4f;x=1dcbc3750c827c8b'<br>
[2016-05-12T06:58:31.430095] Module loaded and initialized
successfully; module='syslogformat'<br>
[2016-05-12T06:58:31.430130] Failed to acquire
/run/systemd/journal/syslog socket, disabling systemd-syslog
source;<br>
[2016-05-12T06:58:31.430749] Error binding socket;
addr='AF_INET(0.0.0.0:6514)', error='Address already in use (98)'<br>
[2016-05-12T06:58:31.430783] Error initializing message pipeline;<br>
[root@syslogserver syslog-ng]# netstat -antup | grep 6514<br>
tcp 0 0 0.0.0.0:6514
0.0.0.0:* LISTEN 14256/syslog-ng <br>
tcp 0 0 192.168.111.231:6514
5.144.32.159:43921 FIN_WAIT2 - <br>
[root@syslogserver syslog-ng]# ps -aef |grep syslog<br>
root 14256 1 0 06:58 ? 00:00:00
/usr/sbin/syslog-ng -F -p /var/run/syslogd.pid<br>
root 14266 10078 0 06:58 pts/0 00:00:00 grep --color=auto
syslog<br>
<br>
</font><br>
<div class="moz-cite-prefix">On 05/12/2016 12:42 PM, jrhendri wrote:<br>
</div>
<blockquote
cite="mid:poa059y8xapsivnik1p43lrj.1463049749862@email.android.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div>This has to be something very basic.</div>
<div>Have you tried checking if another syslog server is running? </div>
<div>ps -aef |grep syslog</div>
<div><br>
</div>
<div>Assuming this shows nothing, try a very simple syslog-ng
config file and a manual start on the command line. </div>
<div><br>
</div>
<div>Make sure you check all the things in your configuration that
your copy should open beforehand. </div>
<div><br>
</div>
<div>This should narrow down the problem I hope :-)</div>
<div><br>
</div>
<div>Jim</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div id="composer_signature">
<div style="font-size:85%;color:#575757" dir="auto">Sent from my
Verizon, Samsung Galaxy smartphone</div>
</div>
<div><br>
</div>
<div style="font-size:100%;color:#000000"><!-- originalMessage -->
<div>-------- Original message --------</div>
<div>From: Ivan Adji - Krstev <a class="moz-txt-link-rfc2396E" href="mailto:akivanradix@gmail.com"><akivanradix@gmail.com></a> </div>
<div>Date: 5/12/16 5:26 AM (GMT-05:00) </div>
<div>To: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a> </div>
<div>Subject: Re: [syslog-ng] Installing Syslog-NG 3.7 on CentOS
7 </div>
<div><br>
</div>
</div>
<font face="Helvetica, Arial, sans-serif">So i have install EPEL
and i have install syslog-ng and mongodb and when i start the
syslog-ng service with <b>syslog-ng -Fevd </b>command i have
the following error AGAIN :). <br>
<br>
Im not sure what is it and how to prevent it and what to do. But
i really need this to work :(.<br>
<br>
[2016-05-12T05:21:10.739940] Error binding socket;
addr='AF_INET(0.0.0.0:6514)', error='Address already in use
(98)'<br>
[2016-05-12T05:21:10.739973] Error initializing message
pipeline;<br>
<br>
<br>
[root@syslogserver loganalyzer]# netstat -tupl <br>
Active Internet connections (only servers)<br>
Proto Recv-Q Send-Q Local Address Foreign
Address State PID/Program name <br>
tcp 0 0 localhost:27017
0.0.0.0:* LISTEN 1352/mongod <br>
tcp 0 0 0.0.0.0:syslog-tls
0.0.0.0:* LISTEN 11377/syslog-ng <br>
tcp 0 0 0.0.0.0:ssh
0.0.0.0:* LISTEN 8562/sshd <br>
tcp 0 0 localhost:smtp
0.0.0.0:* LISTEN 1778/master <br>
tcp6 0 0 [::]:http
[::]:* LISTEN 11264/httpd <br>
tcp6 0 0 [::]:ssh
[::]:* LISTEN 8562/sshd <br>
tcp6 0 0 localhost:smtp
[::]:* LISTEN 1778/master <br>
udp 0 0 0.0.0.0:bootpc
0.0.0.0:* 638/dhclient <br>
udp 0 0 0.0.0.0:60094
0.0.0.0:* 638/dhclient <br>
udp6 0 0 [::]:3126
[::]:* 638/dhclient <br>
<br>
<br>
<br>
[root@syslogserver loganalyzer]# lsof | grep LISTEN<br>
mongod 1352 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 1393 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2028 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2033 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2034 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2138 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2139 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2141 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2148 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2404 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2446 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2447 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2448 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2449 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2450 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 2451 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
mongod 1352 11380 mongod 6u IPv4
17057 0t0 TCP localhost:27017 (LISTEN)<br>
master 1778 root 13u IPv4
15893 0t0 TCP localhost:smtp (LISTEN)<br>
master 1778 root 14u IPv6
15894 0t0 TCP localhost:smtp (LISTEN)<br>
sshd 8562 root 3u IPv4
23963 0t0 TCP *:ssh (LISTEN)<br>
sshd 8562 root 4u IPv6
23965 0t0 TCP *:ssh (LISTEN)<br>
httpd 11264 root 4u IPv6
32697 0t0 TCP *:http (LISTEN)<br>
httpd 11265 apache 4u IPv6
32697 0t0 TCP *:http (LISTEN)<br>
httpd 11267 apache 4u IPv6
32697 0t0 TCP *:http (LISTEN)<br>
httpd 11268 apache 4u IPv6
32697 0t0 TCP *:http (LISTEN)<br>
httpd 11269 apache 4u IPv6
32697 0t0 TCP *:http (LISTEN)<br>
httpd 11270 apache 4u IPv6
32697 0t0 TCP *:http (LISTEN)<br>
httpd 11275 apache 4u IPv6
32697 0t0 TCP *:http (LISTEN)<br>
httpd 11276 apache 4u IPv6
32697 0t0 TCP *:http (LISTEN)<br>
httpd 11277 apache 4u IPv6
32697 0t0 TCP *:http (LISTEN)<br>
httpd 11278 apache 4u IPv6
32697 0t0 TCP *:http (LISTEN)<br>
syslog-ng 11377 root 14u IPv4
34906 0t0 TCP *:syslog-tls (LISTEN)<br>
syslog-ng 11377 11378 root 14u IPv4
34906 0t0 TCP *:syslog-tls (LISTEN)<br>
syslog-ng 11377 11541 root 14u IPv4
34906 0t0 TCP *:syslog-tls (LISTEN)<br>
httpd 11384 apache 4u IPv6
32697 0t0 TCP *:http (LISTEN)<br>
<br>
<br>
<br>
and the source config is as follow:<br>
<br>
source s_sys {<br>
system();<br>
unix-stream("/dev/log");<br>
internal();<br>
network(<br>
port(6514)<br>
# tcp(port(5140));<br>
# file("/proc/kmsg" log_prefix("kernel: "));<br>
transport("tls")<br>
tls( key_file("/etc/syslog-ng/cert.d/serverkey.pem")<br>
cert_file("/etc/syslog-ng/cert.d/servercert.pem")<br>
ca_dir("/etc/syslog-ng/ca.d"))<br>
);<br>
};<br>
<br>
<br>
<br>
<br>
destination d_mongodb {<br>
mongodb(<br>
# servers("localhost:27017")<br>
# database("syslog")<br>
# uri('mongodb://localhost/syslog-ng')<br>
collection("messages")<br>
value-pairs(<br>
scope("selected-macros" "nv-pairs" "sdata")<br>
)<br>
);<br>
};<br>
<br>
<br>
Kind regards<br>
Ivan<br>
</font><br>
<div class="moz-cite-prefix">On 05/10/2016 01:35 PM, Czanik, Péter
wrote:<br>
</div>
<blockquote
cite="mid:CANcUavs5Z1qX-YhoU=sy_pbL7ApkRw2344PMUacWADp=XYaN2A@mail.gmail.com"
type="cite">
<pre wrap="">Do you also have EPEL? The RHEL7/CentOS7 repo is built against EPEL,
as some of the dependencies are missing from the base distribution:
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://fedoraproject.org/wiki/EPEL">https://fedoraproject.org/wiki/EPEL</a>
Bye,
Peter Czanik (CzP) <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:peter.czanik@balabit.com"><peter.czanik@balabit.com></a>
Balabit / syslog-ng upstream
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://czanik.blogs.balabit.com/">http://czanik.blogs.balabit.com/</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://twitter.com/PCzanik">https://twitter.com/PCzanik</a>
On Tue, May 10, 2016 at 1:29 PM, Ivan Adji - Krstev
<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:akivanradix@gmail.com"><akivanradix@gmail.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi i note this error of mine but i try the other one:
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37/repo/epel-7/czanik-syslog-ng37-epel-7.repo">https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37/repo/epel-7/czanik-syslog-ng37-epel-7.repo</a>
And i have the similar errors when ever i try to install on new CentOS
The procedure im doing is: Fresh installation of CentOS
yum update
yum install httpd php vim wget
then install mongodb ( add repo )
then install syslog-ng ( add repo )
I'm using: CentOS Linux release 7.2.1511 (Core)
And im having the following repos:
[root@syslogserver ~]# yum repolist
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: mirror.switch.ch
* extras: mirror.switch.ch
* updates: mirror.switch.ch
repo id
repo name
status
base/7/x86_64
CentOS-7 - Base
9,007
czanik-syslog-ng37/x86_64
Copr repo for syslog-ng37 owned by czanik
59
extras/7/x86_64
CentOS-7 - Extras
266
mongodb-org-3.2/7
MongoDB Repository
35
updates/7/x86_64
CentOS-7 - Updates
1,437
repolist: 10,804
[root@syslogserver ~]# yum install syslog-ng
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: mirror.switch.ch
* extras: mirror.switch.ch
* updates: mirror.switch.ch
Resolving Dependencies
--> Running transaction check
---> Package syslog-ng.x86_64 0:3.7.3-3.el7.centos will be installed
--> Processing Dependency: ivykis >= 0.36.1 for package:
syslog-ng-3.7.3-3.el7.centos.x86_64
--> Processing Dependency: libivykis.so.0(IVYKIS_0.29)(64bit) for package:
syslog-ng-3.7.3-3.el7.centos.x86_64
--> Processing Dependency: libivykis.so.0(IVYKIS_0.30)(64bit) for package:
syslog-ng-3.7.3-3.el7.centos.x86_64
--> Processing Dependency: libevtlog.so.0()(64bit) for package:
syslog-ng-3.7.3-3.el7.centos.x86_64
--> Processing Dependency: libivykis.so.0()(64bit) for package:
syslog-ng-3.7.3-3.el7.centos.x86_64
--> Processing Dependency: libnet.so.1()(64bit) for package:
syslog-ng-3.7.3-3.el7.centos.x86_64
--> Running transaction check
---> Package libnet.x86_64 0:1.1.6-7.el7 will be installed
---> Package syslog-ng.x86_64 0:3.7.3-3.el7.centos will be installed
--> Processing Dependency: ivykis >= 0.36.1 for package:
syslog-ng-3.7.3-3.el7.centos.x86_64
--> Processing Dependency: libivykis.so.0(IVYKIS_0.29)(64bit) for package:
syslog-ng-3.7.3-3.el7.centos.x86_64
--> Processing Dependency: libivykis.so.0(IVYKIS_0.30)(64bit) for package:
syslog-ng-3.7.3-3.el7.centos.x86_64
--> Processing Dependency: libevtlog.so.0()(64bit) for package:
syslog-ng-3.7.3-3.el7.centos.x86_64
--> Processing Dependency: libivykis.so.0()(64bit) for package:
syslog-ng-3.7.3-3.el7.centos.x86_64
--> Finished Dependency Resolution
Error: Package: syslog-ng-3.7.3-3.el7.centos.x86_64 (czanik-syslog-ng37)
Requires: libivykis.so.0(IVYKIS_0.30)(64bit)
Error: Package: syslog-ng-3.7.3-3.el7.centos.x86_64 (czanik-syslog-ng37)
Requires: libivykis.so.0()(64bit)
Error: Package: syslog-ng-3.7.3-3.el7.centos.x86_64 (czanik-syslog-ng37)
Requires: ivykis >= 0.36.1
Error: Package: syslog-ng-3.7.3-3.el7.centos.x86_64 (czanik-syslog-ng37)
Requires: libevtlog.so.0()(64bit)
Error: Package: syslog-ng-3.7.3-3.el7.centos.x86_64 (czanik-syslog-ng37)
Requires: libivykis.so.0(IVYKIS_0.29)(64bit)
You could try using --skip-broken to work around the problem
You could try running: rpm -Va --nofiles --nodigest
Any idea ?
On 05/09/2016 04:09 PM, Czanik, Péter wrote:
Hi,
You should add the repository using the file:
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37/repo/epel-7/czanik-syslog-ng37-epel-7.repo">https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37/repo/epel-7/czanik-syslog-ng37-epel-7.repo</a>
to yum and not just download individual packages. You can use then
"yum install syslog-ng" which will also download all necessary
dependencies.
Bye,
Peter Czanik (CzP) <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:peter.czanik@balabit.com"><peter.czanik@balabit.com></a>
Balabit / syslog-ng upstream
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://czanik.blogs.balabit.com/">http://czanik.blogs.balabit.com/</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://twitter.com/PCzanik">https://twitter.com/PCzanik</a>
On Mon, May 9, 2016 at 3:07 PM, Ivan Adji - Krstev
<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:akivanradix@gmail.com"><akivanradix@gmail.com></a> wrote:
I have the following errors when i try to install Syslog-NG 3.7 on CentOS 7
I have problem when i try to install Syslog-NG 3.7 on CentOS 7.
The following errors i get:
--> Finished Dependency Resolution
Error: Package: syslog-ng-3.7.3-1.el6.x86_64 (czanik-syslog-ng37epel6)
Requires: libevtlog.so.0()(64bit)
Error: Package: syslog-ng-3.7.3-1.el6.x86_64 (czanik-syslog-ng37epel6)
Requires: libpcre.so.0()(64bit)
You could try using --skip-broken to work around the problem
You could try running: rpm -Va --nofiles --nodigest
Any hints on this ?
Kind regards
Ivan
______________________________________________________________________________
Member info: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation:
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
______________________________________________________________________________
Member info: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation:
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
______________________________________________________________________________
Member info: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation:
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<pre wrap="">______________________________________________________________________________
Member info: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<br>
</body>
</html>