<div dir="ltr"><div dir="ltr"><div dir="ltr">Hello,<div><br></div><div>It either looks for a wrong place for the network module or that actually really not installed.</div><div><br></div><div>You could run the following: syslog-ng -V</div><div>That should provide something like this:</div><div><br></div><div><div>syslog-ng 3.20.1.317.g98479aa</div><div>Config version: 3.20</div><div>Installer-Version: 3.20.1.317.g98479aa</div><div>Revision: 3.20.1.317.g98479aa</div><div>Module-Directory: /tmp/install/lib/syslog-ng</div><div>Module-Path: /tmp/install/lib/syslog-ng</div><div>Include-Path: /tmp/install/share/syslog-ng/include</div><div>Available-Modules: xml,tags-parser,system-source,sdjournal,syslogformat,stardate,snmptrapd_parser,riemann,mod-python,pseudofile,pacctformat,map_value_pairs,linux-kmsg-format,kvformat,json-plugin,http,hook-commands,graphite,tfgetent,geoip2-plugin,geoip-plugin,examples,disk-buffer,dbparser,date,csvparser,cryptofuncs,confgen,cef,basicfuncs,appmodel,afuser,afstomp,afsql,afsocket,afprog,affile,afamqp,add_contextual_data</div><div>Enable-Debug: on</div><div>Enable-GProf: off</div><div>Enable-Memtrace: off</div><div>Enable-IPv6: on</div><div>Enable-Spoof-Source: off</div><div>Enable-TCP-Wrapper: off</div><div>Enable-Linux-Caps: on</div><div>Enable-Systemd: on</div></div><div><br></div><div>Check if the "Available-Modules" line has the *afsocket*, if the *afsocket* is not listed there, try to look in the "Module-Path:" directory for *libafsocket.so", if it is missing maybe it is actually in a different package, you may need to install something like syslog-ng-mod-afsocket.</div><div><br></div><div>If you find the *libafsocket.so* in the directory I would run syslog-ng --module-registry -dvt (possibly past its result here) or look for error message as why it cannot load *libafsocket.so*.</div><div><br></div><div><br></div><div>--</div><div>Kokan</div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, May 1, 2019 at 5:22 PM Simon Tyler <<a href="mailto:simon.tyler@aon.com">simon.tyler@aon.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-712297572478444617WordSection1">
<p class="MsoNormal">Hello,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’m new to syslog-ng, and I’m having some trouble just getting it to listen on a tcp port. I’ve tried several different configurations. Some of the start up with no error, but a netstat or lsof command shows that there is no open /listening
tcp port associated with the process. I’m pretty sure my mistake is basic or fundamental, but I haven’t had much luck finding specific details to resolve this issue; there is a fair amount of material to comb through. I’ve tried several different tutorials.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I want a central log server that accepts logs from multiple sources, so I started by trying to configure it to listen on a tcp port, I’m thinking 514 because we don’t use rshell anywhere, but it doesn’t really matter what port.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The current error I’m getting is: <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">[root@ip-10-8-41-60 syslog-ng]# service syslog-ng start<u></u><u></u></p>
<p class="MsoNormal">Error parsing source, source plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 85, column 2:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> network(<u></u><u></u></p>
<p class="MsoNormal"> ^^^^^^^<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The section of the config file related to networking is below; I’ve commented out several attempts.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># s_net = Network listener. This is listening on TCP port 514, no UDP<u></u><u></u></p>
<p class="MsoNormal">#source s_net { tcp(port(514) max-connections(5000)); udp();};<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">#source s_net {<u></u><u></u></p>
<p class="MsoNormal"># tcp(ip(10.8.41.60) port(514));<u></u><u></u></p>
<p class="MsoNormal">#};<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">#source s_net {<u></u><u></u></p>
<p class="MsoNormal"># network(ip(10.8.41.60) port(514));<u></u><u></u></p>
<p class="MsoNormal">#};<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">#source s_network {<u></u><u></u></p>
<p class="MsoNormal"># default-network-drivers();<u></u><u></u></p>
<p class="MsoNormal">#};<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">#source s_syslog { syslog(<u></u><u></u></p>
<p class="MsoNormal"># ip(10.8.41.60) port(514) transport("tcp")); };<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">source s_network {<u></u><u></u></p>
<p class="MsoNormal"> network(<u></u><u></u></p>
<p class="MsoNormal"> ip("10.8.41.60")<u></u><u></u></p>
<p class="MsoNormal"> transport("tcp")<u></u><u></u></p>
<p class="MsoNormal"> listen-backlog(2048)<u></u><u></u></p>
<p class="MsoNormal"> );<u></u><u></u></p>
<p class="MsoNormal">};<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">There is a line at the top of the file:<u></u><u></u></p>
<p class="MsoNormal">@include "scl.conf"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’ve attached the entire file.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Any guidance would be very much appreciated,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b><span lang="EN-CA" style="font-size:8pt;font-family:Arial,sans-serif;color:black">Simon Tyler
</span></b><span lang="EN-CA" style="font-size:8pt;font-family:Arial,sans-serif;color:black">| Senior Systems Administrator -
</span><span style="font-size:8pt;font-family:Arial,sans-serif">PathWise Solutions Group</span><b><span lang="EN-CA" style="font-size:8pt;font-family:Arial,sans-serif;color:black"><br>
</span></b><span style="font-size:8pt;font-family:Arial,sans-serif">Aon</span><span lang="EN-CA" style="font-size:8pt;font-family:Arial,sans-serif"><br>
<span style="color:black">225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada</span><br>
<span style="color:black">t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.</span>979.7724<span style="color:black"><br>
</span><u><span style="color:blue"><a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a><u></u><u></u></span></u></span></p>
<p class="MsoNormal"><i><span lang="EN-CA" style="font-size:10pt;font-family:Arial,sans-serif">PLEASE NOTE that my email address has changed to
<a href="http://simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a></span></i><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>