<div dir="ltr">Thanks for the quick response. Appreciate the info!<br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><br>Craig L Bowser<br>____________________________<br><br>This email is measured by size. Bits and bytes may have settled during transport.<br></div></div>
<br><div class="gmail_quote">On Wed, Nov 15, 2017 at 11:49 AM, Kókai Péter <span dir="ltr"><<a href="mailto:peter.kokai@balabit.com" target="_blank">peter.kokai@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello,<span class=""><div><br></div><br>> 1. Will syslog-ng run just fine receiving udp and sending udp with those errors and without that module? If, so, I don’t care if I don’t get that module.<br><br></span>The modules most of the time are independent, and the network (udp, tcp) are independent of the afql module, so as long as you do not want to use SQL in configuration it shall be fine.<span class=""><br><br>> 2. Is it possible to run syslog-ng and disable that module in the run command?<div><br></div></span><div>In the 3.2 version it loads a few modules by default based on the build configuration, this can be turned off with "@autoload-compiled-modules 0", with using this also make sure that nor in your configuration nor in the included files (scl.conf, module.conf) you do not have "@module afsql".</div><div><br></div><div>In this case it should not try to load the module. (I did not try it myself, this is purely based on code and documentation)</div><span class=""><div><br>> 3. Can I remove syslog-ng and re-install disable that module on install?</div><div><br></div></span><div>I do not think it is possible with install, but via config (see above).<span class=""><br><br>> 4. I’d rather not recompile if I don’t have to, but I found instructions for how to do that. Any tips would be appreciated.</span></div><div><br></div><div>Would you like to re-compile the 3.2 version ?</div><div>For newer version you could check either the docker image file: <a href="https://github.com/balabit/syslog-ng/blob/master/dbld/images/centos7/Dockerfile" target="_blank">https://github.com/<wbr>balabit/syslog-ng/blob/master/<wbr>dbld/images/centos7/Dockerfile</a><wbr> (it has steps to create an environment to compile syslog-ng in centos6)</div><div>Alternatively you could check our Travis CI file for steps: <a href="https://github.com/balabit/syslog-ng/blob/master/.travis.yml" target="_blank">https://github.com/<wbr>balabit/syslog-ng/blob/master/<wbr>.travis.yml</a> (unfortunately this is for ubuntu)<br><div><br></div><div>extra:</div><div><span style="color:rgb(33,33,33)">> yum install --downloadonly syslog-ng-libdbi </span><br></div><div><span style="color:rgb(33,33,33)"><br></span></div><div><span style="color:rgb(33,33,33)">The SQL is depending on the libdbi, which is not part of the syslog-ng, so you should try to find the libdbi packet instead of the syslog-ng-libdbi</span></div><div><br></div><div><br></div><div>--</div><div>Kokan</div></div></div><br><div class="gmail_quote"><div><div class="h5"><div dir="ltr">On Wed, Nov 15, 2017 at 5:16 PM craig bowser <<a href="mailto:reswob10@gmail.com" target="_blank">reswob10@gmail.com</a>> wrote:<br></div></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr"><br><br><p class="MsoNormal">I installed syslog-ng on an offline CentOS 6.x
machine by first downloading all required rpms using this command: <br></p><p class="MsoNormal"><br></p><p class="MsoNormal">yumdownloader --resolve syslog-ng</p><p class="MsoNormal"><br></p>
<p class="MsoNormal">There were two files needed, that did not download
and I downloaded them separately using:</p><p class="MsoNormal"><br></p><p class="MsoNormal"> yumdownloader
eventlog-0.2.13-1.el6.x86_64.<wbr>rpm <br></p><p class="MsoNormal"><br></p><p class="MsoNormal">and: <br></p><p class="MsoNormal"><br></p><p class="MsoNormal">yumdownloader libnet-1.1.6-7.el6.x86_64.rpm</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">These are the files I moved to the offline server: <br></p><p class="MsoNormal"><br></p>
<p class="MsoNormal">17,684 eventlog-0.2.13-1.el6.i686.rpm</p>
<p class="MsoNormal">17,804 eventlog-0.2.13-1.el6.x86_64.<wbr>rpm</p>
<p class="MsoNormal">122,940 gamin-0.1.10-9.el6.i686.rpm</p>
<p class="MsoNormal">1,738,964 glib2-2.28.8-9.el6.i686.rpm</p>
<p class="MsoNormal">4,570,040 glibc-2.12-1.209.el6_9.2.i686.<wbr>rpm</p>
<p class="MsoNormal">117,400 libgcc-4.4.7-18.el6.i686.rpm</p>
<p class="MsoNormal">60,464 libnet-1.1.6-7.el6.i686.rpm</p>
<p class="MsoNormal">59,196 libnet-1.1.6-7.el6.x86_64.rpm</p>
<p class="MsoNormal">111,688 libselinux-2.0.94-7.el6.i686.<wbr>rpm</p>
<p class="MsoNormal">309,920 libstdc++-4.4.7-18.el6.i686.<wbr>rpm</p>
<p class="MsoNormal">161,168 nss-softokn-freebl-3.14.3-23.<wbr>3.el6_8.i686.rpm</p>
<p class="MsoNormal">201,096 pcre-7.8-7.el6.i686.rpm</p>
<p class="MsoNormal">452,548 syslog-ng-3.2.5-4.el6.i686.rpm</p>
<p class="MsoNormal">451,092 syslog-ng-3.2.5-4.el6.x86_64.<wbr>rpm</p>
<p class="MsoNormal">63,536 tcp_wrappers-libs-7.6-58.el6.<wbr>i686.rpm</p>
<p class="MsoNormal">74,284 zlib-1.2.3-29.el6.i686.rpm</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Once I moved all these files to the offline server into their own folder, I ran: <br></p><p class="MsoNormal"><br></p><p class="MsoNormal">rpm –ivh *.rpm <br></p><p class="MsoNormal"><br></p><p class="MsoNormal">to install.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I then checked the config file, made a couple of tweaks, then started syslog-ng using:</p><p class="MsoNormal"><br></p><p class="MsoNormal">service syslog-ng start</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I got the following errors:</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span style="font-family:arial,helvetica,sans-serif"><span style="font-size:10pt">Plugin module not found in 'module-path'; module-path='/lib64/syslog-ng'<wbr>, module='afsql'</span></span></p><span style="font-family:arial,helvetica,sans-serif">
</span><pre><span style="font-family:arial,helvetica,sans-serif">Plugin module not found in 'module-path'; module-path='/lib64/syslog-ng'</span><span style="font-family:arial,helvetica,sans-serif"><wbr>, module='afsql'</span></pre><span style="font-family:arial,helvetica,sans-serif">
</span><p class="MsoNormal"><span style="font-family:arial,helvetica,sans-serif">[ OK ]</span></p><p class="MsoNormal"><span style="font-family:arial,helvetica,sans-serif"><br></span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Syslog-ng was now running, just with these two errors.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">A quick google pointed to the problem, syslog-ng is looking for the sql plugin and the solution: <br></p><p class="MsoNormal"> yum install syslog-ng-libdbi</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">But when I tried to run <br></p><p class="MsoNormal"><br></p><p class="MsoNormal">yumdownloader syslog-ng-libdbi <br></p><p class="MsoNormal"><br></p><p class="MsoNormal">I got <br></p><p class="MsoNormal"><br></p><p class="MsoNormal">"Nothing to download"</p><p class="MsoNormal"><br></p>
<p class="MsoNormal">And when I tried <br></p><p class="MsoNormal"><br></p><p class="MsoNormal">yum install --downloadonly syslog-ng-libdbi <br></p><p class="MsoNormal"><br></p><p class="MsoNormal">I got <br></p><p class="MsoNormal"><br></p><p class="MsoNormal">"Nothing to do"</p>
<p class="MsoNormal"> </p><p class="MsoNormal"><br></p>
<p class="MsoNormal">So here are my questions:</p>
<p class="MsoNormal"> </p>
<p class="m_-5005056569649736779m_8713171164788129393gmail-m_7526587636746347869MsoListParagraph"><span>1.<span style="font:7pt "Times New Roman"">
</span></span>Will syslog-ng run just fine receiving udp and
sending udp with those errors and without that module? If, so, I don’t
care if I don’t get that module.</p>
<p class="m_-5005056569649736779m_8713171164788129393gmail-m_7526587636746347869MsoListParagraph"><span>2.<span style="font:7pt "Times New Roman"">
</span></span>Is it possible to run syslog-ng and disable that module in the run command?</p>
<p class="m_-5005056569649736779m_8713171164788129393gmail-m_7526587636746347869MsoListParagraph"><span>3.<span style="font:7pt "Times New Roman"">
</span></span>Can I remove syslog-ng and re-install disable that module on install?</p>
<p class="m_-5005056569649736779m_8713171164788129393gmail-m_7526587636746347869MsoListParagraph"><span>4.<span style="font:7pt "Times New Roman"">
</span></span>I’d rather not recompile if I don’t have to, but I found instructions for how to do that. Any tips would be appreciated.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thanks.</p>
<br><div><div class="m_-5005056569649736779m_8713171164788129393gmail_signature"><br>Craig L Bowser<br>____________________________<br><br>This email is measured by size. Bits and bytes may have settled during transport.<br></div></div>
</div></div></div>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
</blockquote></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>