<div dir="auto">Hi,<div dir="auto"><br></div><div dir="auto">Where do you see this f_undebug ?</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Feb 18, 2017 9:21 AM, "Anil Panchal" <<a href="mailto:anil.panchal8181@gmail.com">anil.panchal8181@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">Hi Guy's,<br>
I have one question here for you..<br>
What does filter (f_undebug) is used for..? what is the purpose of this function in syslog-ng.conf file specially in syslog forwarding rules..?</p>
<p dir="ltr">Can someone help me on this..?</p>
<p dir="ltr">Thanks in Advance..!!</p>
<p dir="ltr">Thanks<br>
Anil Panchal<br>
</p>
<div class="gmail_quote">On 17-Feb-2017 10:49 pm, "Jordan Ladora" <<a href="mailto:vicepresjoebiden@gmail.com" target="_blank">vicepresjoebiden@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Yes, selinux indeed was the issue. Not sure why my selinux config in the past allowed this, but it was being blocked currently on the default port. <div><br></div><div>Updating the policy with-<div><br></div><div>sudo semanage port -a -t syslogd_port_t -p tcp 36598<br></div><div><br></div><div>...allows syslog-ng to log without having to start it manually from the terminal (where, as you pointed out, it runs unconfined. Otherwise it runs as syslogd_t and by default was limited to ports 514 & 601 and blocked on the default tcp 36598).</div><div><br></div><div>Thank you!</div><div><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 16, 2017 at 6:54 PM, Scheidler, Balázs <span dir="ltr"><<a href="mailto:balazs.scheidler@balabit.com" target="_blank">balazs.scheidler@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>I have now tested this combination on centos 7, and collecting local log messages do seem to work for me.<br><br></div>Please note that syslog-ng will detect whether it is running under systemd at runtime, and it does it this way:<br>```<br> if (lstat("/run/systemd/system/", &st) < 0 || !S_ISDIR(st.st_mode))<br>```<br><br></div><div>e.g. it is checking whether /run/systemd/system is a directory. If it is, the system() source will use systemd-journal() as its source. If this does not exist, it will fall back to /dev/log.<br><br></div><div>syslog-ng would report the result of this check with a debug level message:<br>```<br> msg_debug("Systemd is not detected as the running init system");<br>```<br><br></div><div>or <br><br>```<br> msg_debug("Systemd is detected as the running init system");<br>```<br><br></div><div>The program destination stuff should really be independent of the init system, but a different AppArmor/SELinux config might be the culprit though. When you launch it from the console, it would be unconfined, but with systemd, a policy might be applied that does NOT allow executing external programs.<br><br></div><div>I hope this helps.<span class="m_5127418104646895751m_2544008924402604747HOEnZb"><font color="#888888"><br></font></span></div><span class="m_5127418104646895751m_2544008924402604747HOEnZb"><font color="#888888"><div><br></div></font></span></div><div class="gmail_extra"><span class="m_5127418104646895751m_2544008924402604747HOEnZb"><font color="#888888"><br clear="all"><div><div class="m_5127418104646895751m_2544008924402604747m_-6151885752033712920gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div></font></span><div><div class="m_5127418104646895751m_2544008924402604747h5">
<br><div class="gmail_quote">On Mon, Feb 13, 2017 at 6:54 AM, Fabien Wernli <span dir="ltr"><<a href="mailto:wernli@in2p3.fr" target="_blank">wernli@in2p3.fr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Fri, Feb 10, 2017 at 09:32:21PM +0000, Clayton Dukes wrote:<br>
> If I do a 'systemctl stop syslog-ng' and then just simply type 'syslog-ng' (no foreground, debug, etc. switches) from the command line, it works fine.<br>
> Rather confusing, but I can't see why the systemctl file is not working as it should.<br>
> Any ideas?<br>
<br>
</span>try this: in a terminal run `journalctl -f` as root.<br>
In another terminal, run `systemctl start syslog-ng`.<br>
<br>
If you don't see anything useful on the journalctl terminal, try increasing<br>
the verbosity of syslog-ng (either by editing `/etc/sysconfig/syslog-ng`,<br>
or by modifying<br>
`/lib/systemd/system/syslog-ng<wbr>.service` and running `systemctl daemon-reload`).<br>
<br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
</blockquote></div><br></div></div></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div></div>