<div dir="auto">Hi,<div dir="auto"><br></div><div dir="auto">Do you have a libjson-plugin.so in syslog-ng --module-registry output? Also, can you check your configure output if libjson-c was detected?</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Feb 23, 2017 20:27, "David Hauck" <<a href="mailto:davidh@netacquire.com">davidh@netacquire.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
On Thursday, February 23, 2017 10:56 AM, David Hauck wrote:<br>
> Hi Noémi,<br>
><br>
> Excellent information, thx! I'll give this a try...<br>
<br>
So this corrected the failures and I now have syslog-ng running again with my pre-existing configuration.<br>
<br>
I'd like to come back to the "format-json" error (corrected by removing the /usr/share/syslog-ng/include/<wbr>scl/cim folder). I went back and looked at my build configuration and see that I didn't have "--enable-json" present. Thinking this might have been at the root of this problem I rebuilt and redeployed. However, I still see this error. Is there a better way to fix this?<br>
<br>
Regards,<br>
-David<br>
<br>
> Thanks again,<br>
> -David<br>
><br>
> On Thursday, February 23, 2017 8:50 AM, syslog-ng wrote:<br>
>> Syslog-ng stores persistent options and data in syslog-ng.persist file.<br>
>> It contains data about drivers specified in the configuration. The<br>
>> drivers are identified by their "settings". In your case you have<br>
>> three file drivers which contain the same log file: "/var/log/abc/audit_log".<br>
>> Thus, the id of that driver is not unique. To provide a unique<br>
>> identifier for these drivers you must specify a different string in<br>
>> persist-name.<br>
>><br>
>> For example, you could add persist-name("abcaudit") to driver<br>
>> d_abcaudit, persist- name("abcaudit_Prio") to driver d_abcaudit_Prio<br>
>> and persist-name("abcaudit_IPtab") to d_abcaudit_IPtab. The key is that<br>
>> the string in persist-name is unique.<br>
>><br>
>> Previously, handling multiple drivers on the same thing was broken in<br>
>> the usage of the persist file, if I recall correctly. This<br>
>> persist-name option was introduced to fix the problem. So, in previous versions it was buggy.<br>
>><br>
>> BR,<br>
>> kvch<br>
>><br>
>> On 23 February 2017 at 16:43, David Hauck <<a href="mailto:davidh@netacquire.com">davidh@netacquire.com</a><br>
>> <mailto:<a href="mailto:davidh@netacquire.com">davidh@netacquire.com</a>> > wrote:<br>
>><br>
>> Hi András,<br>
>><br>
>> On Thu, 23 Feb 2017 at 00:22:00, syslog-ng wrote: > Hi David, > ><br>
>> The issue with persist_name() option was mentioned (and solved) ><br>
>> previously in: <a href="https://github.com/balabit/syslog-" rel="noreferrer" target="_blank">https://github.com/balabit/<wbr>syslog-</a><br>
>> <<a href="https://github.com/balabit/syslog-" rel="noreferrer" target="_blank">https://github.com/balabit/<wbr>syslog-</a>> > ng/issues/1275<br>
>><br>
>> Thx, I'd seen that entry prior to my email, however, it wasn't clear<br>
>> to me what exactly this doing. And I wasn't able to find anything in<br>
>> the documentation regarding the persist-name() option. Moreover, I<br>
>> wasn't sure if this would work with my 'destination' specification (as<br>
>> seen below).<br>
>><br>
>> What exactly does "persit-name()" do? How exactly do I specifcy this<br>
>> for my destination specifications below? And what has changed between<br>
>> these two versions to now require this option?<br>
>><br>
>> Thanks,<br>
>> -David<br>
>><br>
>><br>
>> > Br, > Andras > > > On Thu, Feb 23, 2017 at 1:28 AM, David Hauck<br>
>> <<a href="mailto:davidh@netacquire.com">davidh@netacquire.com</a> <mailto:<a href="mailto:davidh@netacquire.com">davidh@netacquire.com</a>> > > wrote: > ><br>
>> > Hi, > > I'm in the processing or updating a<br>
>> distribution's v3.6.3 syslog-ng > configuration to v3.9.1 and am<br>
>> running into some issues getting > syslog-ng started. The first one<br>
>> was: > > Starting syslog-ng: Error parsing config, Error<br>
>> compiling template > (Unknown template function "format-json") in ><br>
>> /usr/share/syslog-ng/include/<wbr>scl/cim/template.conf at line 23, column ><br>
>> 32 > > I found a reference online to fixing this by removing ><br>
>> /usr/share/syslog-ng/include/<wbr>scl/cim and this indeed got me past this ><br>
>> error (hopefully this is an otherwise benign modification). > ><br>
>> I'm now stuck at the following error: > > Starting syslog-ng:<br>
>> [2017-02-22T08:07:50.101422] Error checking the > uniqueness of the<br>
>> persist names, please override it with persist-name > option. Shutting<br>
>> down.; > persist_name='affile_dd_<wbr>writers(/var/log/abc/audit_<wbr>log)', ><br>
>> location='/etc/syslog-ng.conf:<wbr>128:33' > > Here's snippet from my<br>
>> configuration file that this error message > references: > ><br>
>> ... > destination d_abcaudit {<br>
>> file("/var/log/abc/audit_log" > template(t_NAFormat)); }; ><br>
>> destination d_abcaudit_Prio { file("/var/log/abc/audit_log" ><br>
>> template(t_NAFormat_Prio)); }; > --> destination<br>
>> d_abcaudit_IPtab { > file("/var/log/abc/audit_log"<br>
>> template(t_abcFormat_IPtab)); }; > destination d_abcmessage_Prio<br>
>> { file("/dev/null"); }; > ... > > I wasn't able to find<br>
>> any documentation or guidance on the > "persist-name" option. Any ideas<br>
>> on how I should go about fixing this > error? > > Thanks, ><br>
>> -David<br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
</blockquote></div></div>