<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m new to syslog-ng, and I’m having some trouble just getting it to listen on a tcp port. I’ve tried several different configurations. Some of the start up with no error, but a netstat or lsof command shows that there is no open /listening
tcp port associated with the process. I’m pretty sure my mistake is basic or fundamental, but I haven’t had much luck finding specific details to resolve this issue; there is a fair amount of material to comb through. I’ve tried several different tutorials.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I want a central log server that accepts logs from multiple sources, so I started by trying to configure it to listen on a tcp port, I’m thinking 514 because we don’t use rshell anywhere, but it doesn’t really matter what port.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The current error I’m getting is: <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[root@ip-10-8-41-60 syslog-ng]# service syslog-ng start<o:p></o:p></p>
<p class="MsoNormal">Error parsing source, source plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 85, column 2:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> network(<o:p></o:p></p>
<p class="MsoNormal"> ^^^^^^^<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The section of the config file related to networking is below; I’ve commented out several attempts.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># s_net = Network listener. This is listening on TCP port 514, no UDP<o:p></o:p></p>
<p class="MsoNormal">#source s_net { tcp(port(514) max-connections(5000)); udp();};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">#source s_net {<o:p></o:p></p>
<p class="MsoNormal"># tcp(ip(10.8.41.60) port(514));<o:p></o:p></p>
<p class="MsoNormal">#};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">#source s_net {<o:p></o:p></p>
<p class="MsoNormal"># network(ip(10.8.41.60) port(514));<o:p></o:p></p>
<p class="MsoNormal">#};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">#source s_network {<o:p></o:p></p>
<p class="MsoNormal"># default-network-drivers();<o:p></o:p></p>
<p class="MsoNormal">#};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">#source s_syslog { syslog(<o:p></o:p></p>
<p class="MsoNormal"># ip(10.8.41.60) port(514) transport("tcp")); };<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">source s_network {<o:p></o:p></p>
<p class="MsoNormal"> network(<o:p></o:p></p>
<p class="MsoNormal"> ip("10.8.41.60")<o:p></o:p></p>
<p class="MsoNormal"> transport("tcp")<o:p></o:p></p>
<p class="MsoNormal"> listen-backlog(2048)<o:p></o:p></p>
<p class="MsoNormal"> );<o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">There is a line at the top of the file:<o:p></o:p></p>
<p class="MsoNormal">@include "scl.conf"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve attached the entire file.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any guidance would be very much appreciated,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span lang="EN-CA" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:EN-GB">Simon Tyler
</span></b><span lang="EN-CA" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:EN-GB">| Senior Systems Administrator -
</span><span style="font-size:8.0pt;font-family:"Arial","sans-serif"">PathWise Solutions Group</span><b><span lang="EN-CA" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:EN-GB"><br>
</span></b><span style="font-size:8.0pt;font-family:"Arial","sans-serif"">Aon</span><span lang="EN-CA" style="font-size:8.0pt;font-family:"Arial","sans-serif";mso-fareast-language:EN-GB"><br>
<span style="color:black">225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada</span><br>
<span style="color:black">t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.</span>979.7724<span style="color:black"><br>
</span><u><span style="color:blue"><a href="mailto:simon.tyler@aon.com">simon.tyler@aon.com</a><o:p></o:p></span></u></span></p>
<p class="MsoNormal"><i><span lang="EN-CA" style="font-size:10.0pt;font-family:"Arial","sans-serif"">PLEASE NOTE that my email address has changed to
<a href="simon.tyler@aon.com">simon.tyler@aon.com</a></span></i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>