<div dir="ltr">Hello,<div><br></div><div>A really dummy question, but does your source is used in any logpath ?</div><div>If not try to use in one logpath.</div><div><br></div><div>--</div><div>Kokan</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, May 2, 2019 at 5:32 PM Simon Tyler <<a href="mailto:simon.tyler@aon.com">simon.tyler@aon.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Peter,<br>
<br>
I commented out the network entry and uncommented this tcp entry:<br>
source s_net {<br>
tcp(ip(10.8.41.60) port(514));<br>
};<br>
<br>
I can see syslog-ng start up and process local log messages:<br>
<br>
[root@ip-10-8-41-60 syslog-ng]# syslog-ng --debug<br>
Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so'<br>
Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so'<br>
Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so'<br>
Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so'<br>
Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so'<br>
Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so'<br>
Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so'<br>
Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so'<br>
Trying to open module; module='afsql', filename='/lib64/syslog-ng/libafsql.so'<br>
Starting to read include file; filename='/etc/syslog-ng/scl.conf', depth='1'<br>
Global value changed; define='scl-root', value='/usr/share/syslog-ng/include/scl'<br>
Global value changed; define='include-path', value='/etc/syslog-ng:/usr/share/syslog-ng/include'<br>
Starting to read include file; filename='/etc/syslog-ng/modules.conf', depth='2'<br>
Global value changed; define='autoload-compiled-modules', value='0'<br>
Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so'<br>
Attempted to register the same plugin multiple times, ignoring; context='format', name='syslog'<br>
Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so'<br>
Attempted to register the same plugin multiple times, ignoring; context='template-func', name='echo'<br>
Attempted to register the same plugin multiple times, ignoring; context='template-func', name='grep'<br>
Attempted to register the same plugin multiple times, ignoring; context='template-func', name='if'<br>
Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so'<br>
Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-stream'<br>
Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-stream'<br>
Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-dgram'<br>
Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-dgram'<br>
Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp'<br>
Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp'<br>
Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp6'<br>
Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp6'<br>
Attempted to register the same plugin multiple times, ignoring; context='source', name='udp'<br>
Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp'<br>
Attempted to register the same plugin multiple times, ignoring; context='source', name='udp6'<br>
Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp6'<br>
Attempted to register the same plugin multiple times, ignoring; context='source', name='syslog'<br>
Attempted to register the same plugin multiple times, ignoring; context='destination', name='syslog'<br>
Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so'<br>
Attempted to register the same plugin multiple times, ignoring; context='source', name='file'<br>
Attempted to register the same plugin multiple times, ignoring; context='source', name='pipe'<br>
Attempted to register the same plugin multiple times, ignoring; context='destination', name='file'<br>
Attempted to register the same plugin multiple times, ignoring; context='destination', name='pipe'<br>
Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so'<br>
Attempted to register the same plugin multiple times, ignoring; context='source', name='program'<br>
Attempted to register the same plugin multiple times, ignoring; context='destination', name='program'<br>
Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so'<br>
Attempted to register the same plugin multiple times, ignoring; context='destination', name='usertty'<br>
Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so'<br>
Attempted to register the same plugin multiple times, ignoring; context='parser', name='db-parser'<br>
Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so'<br>
Attempted to register the same plugin multiple times, ignoring; context='parser', name='csv-parser'<br>
Finishing include; filename='/etc/syslog-ng/modules.conf', depth='2'<br>
Starting to read include file; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2'<br>
Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so'<br>
Finishing include; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2'<br>
Starting to read include file; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2'<br>
Finishing include; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2'<br>
Starting to read include file; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2'<br>
Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so'<br>
Finishing include; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2'<br>
Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1'<br>
Running application hooks; hook='1'<br>
Running application hooks; hook='3'<br>
syslog-ng starting up; version='3.2.5'<br>
Incoming log entry; line='<30>May 2 15:20:55 dhclient[1689]: XMT: Solicit on eth0, interval 129080ms.'<br>
<br>
But, there is no syslog process listening on port 514 or any other port.<br>
I did try upgrading to a more recent version 3.19 from here: <a href="https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng319/repo/epel-7/czanik-syslog-ng319-epel-7.repo" rel="noreferrer" target="_blank">https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng319/repo/epel-7/czanik-syslog-ng319-epel-7.repo</a> however this is an Amazon linux instance and it appears to conflict with some of the operating system packages. <br>
<br>
I thought I would check in with you one more time to see if you have any other suggestions; otherwise, I can try Centos and a more recent version of syslog-ng.<br>
<br>
Thanks again for your help,<br>
<br>
Simon Tyler | Senior Systems Administrator - PathWise Solutions Group<br>
Aon<br>
225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada<br>
t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724<br>
<a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a><br>
PLEASE NOTE that my email address has changed to <a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a><br>
<br>
<br>
-----Original Message-----<br>
From: syslog-ng [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>] On Behalf Of <a href="mailto:syslog-ng-request@lists.balabit.hu" target="_blank">syslog-ng-request@lists.balabit.hu</a><br>
Sent: Thursday, May 02, 2019 1:23 AM<br>
To: <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
Subject: syslog-ng Digest, Vol 169, Issue 3<br>
<br>
Send syslog-ng mailing list submissions to<br>
<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:syslog-ng-request@lists.balabit.hu" target="_blank">syslog-ng-request@lists.balabit.hu</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:syslog-ng-owner@lists.balabit.hu" target="_blank">syslog-ng-owner@lists.balabit.hu</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of syslog-ng digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: syslog-ng Digest, Vol 169, Issue 1 (Péter)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Thu, 2 May 2019 07:22:28 +0200<br>
From: Péter, Kókai <<a href="mailto:peter.kokai@oneidentity.com" target="_blank">peter.kokai@oneidentity.com</a>><br>
To: "Syslog-ng users' and developers' mailing list"<br>
<<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
Subject: Re: [syslog-ng] syslog-ng Digest, Vol 169, Issue 1<br>
Message-ID:<br>
<<a href="mailto:CABxQCphefFz0VVvGYVkGzMr6GzUPbeHVp3b8Gq_fbgcRazKJaQ@mail.gmail.com" target="_blank">CABxQCphefFz0VVvGYVkGzMr6GzUPbeHVp3b8Gq_fbgcRazKJaQ@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Hello,<br>
<br>
Okay I see it now. You are using a version (3.2) which as far as I can see<br>
did not have *network* keyword at all.<br>
Instead of *network*, you could use tcp, udp, tls, ...<br>
<br>
Or even better upgrade to something much newer if possible :)<br>
<br>
The "Avaiable-Modules" is also a later feature, so that was a reason not to<br>
show up the list of modules, not the lack of them.<br>
<br>
--<br>
Kokan<br>
<br>
On Wed, May 1, 2019 at 9:41 PM Simon Tyler <<a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a>> wrote:<br>
<br>
> Hi Kohan,<br>
><br>
> It appears that modules are not loading?<br>
><br>
> [root@ip-10-8-41-60 syslog-ng]# syslog-ng -V<br>
> syslog-ng 3.2.5<br>
> Installer-Version: 3.2.5<br>
> Revision: ssh+git://bazsi@git.balabit<br>
> //var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#9d4bea28198bd731df1a61e980a2af5b88d81116<br>
> Compile-Date: Jul 25 2014 15:20:50<br>
> Enable-Threads: on<br>
> Enable-Debug: off<br>
> Enable-GProf: off<br>
> Enable-Memtrace: off<br>
> Enable-Sun-STREAMS: off<br>
> Enable-IPv6: on<br>
> Enable-Spoof-Source: on<br>
> Enable-TCP-Wrapper: on<br>
> Enable-SSL: off<br>
> Enable-SQL: on<br>
> Enable-Linux-Caps: off<br>
> Enable-Pcre: on<br>
> Enable-Pacct: off<br>
><br>
> -------------------------------------------------------------<br>
> I tried putting full path to modules.conf in scl.conf:<br>
><br>
> [root@ip-10-8-41-60 syslog-ng]# cat scl.conf<br>
><br>
> #############################################################################<br>
> # Copyright (c) 2010 BalaBit IT Ltd, Budapest, Hungary<br>
> #<br>
> # This program is free software; you can redistribute it and/or modify it<br>
> # under the terms of the GNU General Public License version 2 as published<br>
> # by the Free Software Foundation, or (at your option) any later version.<br>
> #<br>
> # As an additional exemption you are allowed to compile & link against the<br>
> # OpenSSL libraries as published by the OpenSSL project. See the file<br>
> # COPYING for details.<br>
> #<br>
> # This program is distributed in the hope that it will be useful,<br>
> # but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
> # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the<br>
> # GNU General Public License for more details.<br>
> #<br>
> # You should have received a copy of the GNU General Public License<br>
> # along with this program; if not, write to the Free Software<br>
> # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301<br>
> USA<br>
> #<br>
><br>
> #############################################################################<br>
> #<br>
> # This file is placed into /etc/syslog-ng in order to make it trivial to<br>
> # include in user written syslog-ng.conf files. It sets up 'scl-root' and<br>
> # `include-path`, then includes all SCL supplied plugins.<br>
> #<br>
><br>
> @define scl-root "`syslog-ng-data`/include/scl"<br>
> @define include-path "`include-path`:`syslog-ng-data`/include"<br>
><br>
> #@include 'modules.conf'<br>
> @include '/etc/syslog-ng/modules.conf'<br>
> @include 'scl/system/plugin.conf'<br>
> @include 'scl/pacct/plugin.conf'<br>
> @include 'scl/syslogconf/plugin.conf'<br>
><br>
> ---------------------------------------------------<br>
> Debug it seems to be trying to open modules, and it knows where they live:<br>
> [root@ip-10-8-41-60 syslog-ng]# syslog-ng --debug<br>
> Trying to open module; module='syslogformat',<br>
> filename='/lib64/syslog-ng/libsyslogformat.so'<br>
> Trying to open module; module='basicfuncs',<br>
> filename='/lib64/syslog-ng/libbasicfuncs.so'<br>
> Trying to open module; module='afsocket',<br>
> filename='/lib64/syslog-ng/libafsocket.so'<br>
> Trying to open module; module='affile',<br>
> filename='/lib64/syslog-ng/libaffile.so'<br>
> Trying to open module; module='afprog',<br>
> filename='/lib64/syslog-ng/libafprog.so'<br>
> Trying to open module; module='afuser',<br>
> filename='/lib64/syslog-ng/libafuser.so'<br>
> Trying to open module; module='dbparser',<br>
> filename='/lib64/syslog-ng/libdbparser.so'<br>
> Trying to open module; module='csvparser',<br>
> filename='/lib64/syslog-ng/libcsvparser.so'<br>
> Trying to open module; module='afsql',<br>
> filename='/lib64/syslog-ng/libafsql.so'<br>
> Starting to read include file; filename='/etc/syslog-ng/scl.conf',<br>
> depth='1'<br>
> Global value changed; define='scl-root',<br>
> value='/usr/share/syslog-ng/include/scl'<br>
> Global value changed; define='include-path',<br>
> value='/etc/syslog-ng:/usr/share/syslog-ng/include'<br>
> Starting to read include file; filename='/etc/syslog-ng/modules.conf',<br>
> depth='2'<br>
> Global value changed; define='autoload-compiled-modules', value='0'<br>
> Trying to open module; module='syslogformat',<br>
> filename='/lib64/syslog-ng/libsyslogformat.so'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='format', name='syslog'<br>
> Trying to open module; module='basicfuncs',<br>
> filename='/lib64/syslog-ng/libbasicfuncs.so'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='template-func', name='echo'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='template-func', name='grep'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='template-func', name='if'<br>
> Trying to open module; module='afsocket',<br>
> filename='/lib64/syslog-ng/libafsocket.so'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='source', name='unix-stream'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='destination', name='unix-stream'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='source', name='unix-dgram'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='destination', name='unix-dgram'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='source', name='tcp'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='destination', name='tcp'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='source', name='tcp6'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='destination', name='tcp6'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='source', name='udp'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='destination', name='udp'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='source', name='udp6'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='destination', name='udp6'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='source', name='syslog'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='destination', name='syslog'<br>
> Trying to open module; module='affile',<br>
> filename='/lib64/syslog-ng/libaffile.so'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='source', name='file'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='source', name='pipe'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='destination', name='file'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='destination', name='pipe'<br>
> Trying to open module; module='afprog',<br>
> filename='/lib64/syslog-ng/libafprog.so'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='source', name='program'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='destination', name='program'<br>
> Trying to open module; module='afuser',<br>
> filename='/lib64/syslog-ng/libafuser.so'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='destination', name='usertty'<br>
> Trying to open module; module='dbparser',<br>
> filename='/lib64/syslog-ng/libdbparser.so'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='parser', name='db-parser'<br>
> Trying to open module; module='csvparser',<br>
> filename='/lib64/syslog-ng/libcsvparser.so'<br>
> Attempted to register the same plugin multiple times, ignoring;<br>
> context='parser', name='csv-parser'<br>
> Finishing include; filename='/etc/syslog-ng/modules.conf', depth='2'<br>
> Starting to read include file;<br>
> filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2'<br>
> Trying to open module; module='confgen',<br>
> filename='/lib64/syslog-ng/libconfgen.so'<br>
> Finishing include;<br>
> filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2'<br>
> Starting to read include file;<br>
> filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2'<br>
> Finishing include;<br>
> filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2'<br>
> Starting to read include file;<br>
> filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf',<br>
> depth='2'<br>
> Trying to open module; module='confgen',<br>
> filename='/lib64/syslog-ng/libconfgen.so'<br>
> Finishing include;<br>
> filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf',<br>
> depth='2'<br>
> Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1'<br>
> Error parsing source, source plugin network not found in<br>
> /etc/syslog-ng/syslog-ng.conf at line 85, column 2:<br>
><br>
> network(<br>
> ^^^^^^^<br>
> ---------------------------------------------------------------<br>
> It is not clear to me what the name is for network module; here are the<br>
> modules in the file system:<br>
> [root@ip-10-8-41-60 syslog-ng]# ls /lib64/syslog-ng/<br>
> libaffile.so libafsocket-notls.so libafsql.so libbasicfuncs.so<br>
> libconvertfuncs.so libdbparser.so libsyslogformat.so<br>
> libafprog.so libafsocket.so libafuser.so libconfgen.so<br>
> libcsvparser.so libdummy.so<br>
><br>
> Thank you for your advice,<br>
><br>
><br>
><br>
><br>
> Simon Tyler | Senior Systems Administrator - PathWise Solutions Group<br>
> Aon<br>
> 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada<br>
> t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724<br>
> <a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a><br>
> PLEASE NOTE that my email address has changed to <a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a><br>
><br>
><br>
><br>
> -----Original Message-----<br>
> From: syslog-ng [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>] On Behalf Of<br>
> <a href="mailto:syslog-ng-request@lists.balabit.hu" target="_blank">syslog-ng-request@lists.balabit.hu</a><br>
> Sent: Wednesday, May 01, 2019 12:47 PM<br>
> To: <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
> Subject: syslog-ng Digest, Vol 169, Issue 1<br>
><br>
> Send syslog-ng mailing list submissions to<br>
> <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
><br>
> To subscribe or unsubscribe via the World Wide Web, visit<br>
> <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> or, via email, send a message with subject or body 'help' to<br>
> <a href="mailto:syslog-ng-request@lists.balabit.hu" target="_blank">syslog-ng-request@lists.balabit.hu</a><br>
><br>
> You can reach the person managing the list at<br>
> <a href="mailto:syslog-ng-owner@lists.balabit.hu" target="_blank">syslog-ng-owner@lists.balabit.hu</a><br>
><br>
> When replying, please edit your Subject line so it is more specific<br>
> than "Re: Contents of syslog-ng digest..."<br>
><br>
><br>
> Today's Topics:<br>
><br>
> 1. source plugin network not found/problems getting syslog-ng<br>
> to listen on tcp port (Simon Tyler)<br>
> 2. Re: source plugin network not found/problems getting<br>
> syslog-ng to listen on tcp port (Péter)<br>
><br>
><br>
> ----------------------------------------------------------------------<br>
><br>
> Message: 1<br>
> Date: Wed, 1 May 2019 15:22:26 +0000<br>
> From: Simon Tyler <<a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a>><br>
> To: "<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>" <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
> Subject: [syslog-ng] source plugin network not found/problems getting<br>
> syslog-ng to listen on tcp port<br>
> Message-ID:<br>
> <<br>
> <a href="mailto:DM5P170MB0015DD8BF273A79D22817BAAFB3B0@DM5P170MB0015.NAMP170.PROD.OUTLOOK.COM" target="_blank">DM5P170MB0015DD8BF273A79D22817BAAFB3B0@DM5P170MB0015.NAMP170.PROD.OUTLOOK.COM</a><br>
> ><br>
><br>
> Content-Type: text/plain; charset="utf-8"<br>
><br>
> Hello,<br>
><br>
> I'm new to syslog-ng, and I'm having some trouble just getting it to<br>
> listen on a tcp port. I've tried several different configurations. Some of<br>
> the start up with no error, but a netstat or lsof command shows that there<br>
> is no open /listening tcp port associated with the process. I'm pretty sure<br>
> my mistake is basic or fundamental, but I haven't had much luck finding<br>
> specific details to resolve this issue; there is a fair amount of material<br>
> to comb through. I've tried several different tutorials.<br>
><br>
> I want a central log server that accepts logs from multiple sources, so I<br>
> started by trying to configure it to listen on a tcp port, I'm thinking 514<br>
> because we don't use rshell anywhere, but it doesn't really matter what<br>
> port.<br>
><br>
> The current error I'm getting is:<br>
><br>
> [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start<br>
> Error parsing source, source plugin network not found in<br>
> /etc/syslog-ng/syslog-ng.conf at line 85, column 2:<br>
><br>
> network(<br>
> ^^^^^^^<br>
><br>
> The section of the config file related to networking is below; I've<br>
> commented out several attempts.<br>
><br>
> # s_net = Network listener. This is listening on TCP port 514, no UDP<br>
> #source s_net { tcp(port(514) max-connections(5000)); udp();};<br>
><br>
> #source s_net {<br>
> # tcp(ip(10.8.41.60) port(514));<br>
> #};<br>
><br>
> #source s_net {<br>
> # network(ip(10.8.41.60) port(514));<br>
> #};<br>
><br>
> #source s_network {<br>
> # default-network-drivers();<br>
> #};<br>
><br>
> #source s_syslog { syslog(<br>
> # ip(10.8.41.60) port(514) transport("tcp")); };<br>
><br>
> source s_network {<br>
> network(<br>
> ip("10.8.41.60")<br>
> transport("tcp")<br>
> listen-backlog(2048)<br>
> );<br>
> };<br>
><br>
> There is a line at the top of the file:<br>
> @include "scl.conf"<br>
><br>
> I've attached the entire file.<br>
><br>
> Any guidance would be very much appreciated,<br>
><br>
> Simon Tyler | Senior Systems Administrator - PathWise Solutions Group<br>
> Aon<br>
> 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada<br>
> t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724<br>
> <a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a><mailto:<a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a>><br>
> PLEASE NOTE that my email address has changed to <a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a><br>
><br>
> -------------- next part --------------<br>
> An HTML attachment was scrubbed...<br>
> URL: <<br>
> <a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/attachment-0001.html" rel="noreferrer" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/attachment-0001.html</a><br>
> ><br>
> -------------- next part --------------<br>
> A non-text attachment was scrubbed...<br>
> Name: syslog-ng.conf<br>
> Type: application/octet-stream<br>
> Size: 4159 bytes<br>
> Desc: syslog-ng.conf<br>
> URL: <<br>
> <a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/attachment-0001.obj" rel="noreferrer" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/attachment-0001.obj</a><br>
> ><br>
><br>
> ------------------------------<br>
><br>
> Message: 2<br>
> Date: Wed, 1 May 2019 18:46:41 +0200<br>
> From: Péter, Kókai <<a href="mailto:peter.kokai@oneidentity.com" target="_blank">peter.kokai@oneidentity.com</a>><br>
> To: "Syslog-ng users' and developers' mailing list"<br>
> <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
> Subject: Re: [syslog-ng] source plugin network not found/problems<br>
> getting syslog-ng to listen on tcp port<br>
> Message-ID:<br>
> <CABxQCphBGgTm47G=<br>
> <a href="mailto:KVSB67Ri6BRKUZYgX-HvAj1SrS9ofMoaoQ@mail.gmail.com" target="_blank">KVSB67Ri6BRKUZYgX-HvAj1SrS9ofMoaoQ@mail.gmail.com</a>><br>
> Content-Type: text/plain; charset="utf-8"<br>
><br>
> Hello,<br>
><br>
> It either looks for a wrong place for the network module or that actually<br>
> really not installed.<br>
><br>
> You could run the following: syslog-ng -V<br>
> That should provide something like this:<br>
><br>
> syslog-ng 3.20.1.317.g98479aa<br>
> Config version: 3.20<br>
> Installer-Version: 3.20.1.317.g98479aa<br>
> Revision: 3.20.1.317.g98479aa<br>
> Module-Directory: /tmp/install/lib/syslog-ng<br>
> Module-Path: /tmp/install/lib/syslog-ng<br>
> Include-Path: /tmp/install/share/syslog-ng/include<br>
> Available-Modules:<br>
><br>
> xml,tags-parser,system-source,sdjournal,syslogformat,stardate,snmptrapd_parser,riemann,mod-python,pseudofile,pacctformat,map_value_pairs,linux-kmsg-format,kvformat,json-plugin,http,hook-commands,graphite,tfgetent,geoip2-plugin,geoip-plugin,examples,disk-buffer,dbparser,date,csvparser,cryptofuncs,confgen,cef,basicfuncs,appmodel,afuser,afstomp,afsql,afsocket,afprog,affile,afamqp,add_contextual_data<br>
> Enable-Debug: on<br>
> Enable-GProf: off<br>
> Enable-Memtrace: off<br>
> Enable-IPv6: on<br>
> Enable-Spoof-Source: off<br>
> Enable-TCP-Wrapper: off<br>
> Enable-Linux-Caps: on<br>
> Enable-Systemd: on<br>
><br>
> Check if the "Available-Modules" line has the *afsocket*, if the *afsocket*<br>
> is not listed there, try to look in the "Module-Path:" directory for<br>
> *libafsocket.so", if it is missing maybe it is actually in a different<br>
> package, you may need to install something like syslog-ng-mod-afsocket.<br>
><br>
> If you find the *libafsocket.so* in the directory I would run<br>
> syslog-ng --module-registry -dvt (possibly past its result here) or look<br>
> for error message as why it cannot load *libafsocket.so*.<br>
><br>
><br>
> --<br>
> Kokan<br>
><br>
> On Wed, May 1, 2019 at 5:22 PM Simon Tyler <<a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a>> wrote:<br>
><br>
> > Hello,<br>
> ><br>
> ><br>
> ><br>
> > I’m new to syslog-ng, and I’m having some trouble just getting it to<br>
> > listen on a tcp port. I’ve tried several different configurations. Some<br>
> of<br>
> > the start up with no error, but a netstat or lsof command shows that<br>
> there<br>
> > is no open /listening tcp port associated with the process. I’m pretty<br>
> sure<br>
> > my mistake is basic or fundamental, but I haven’t had much luck finding<br>
> > specific details to resolve this issue; there is a fair amount of<br>
> material<br>
> > to comb through. I’ve tried several different tutorials.<br>
> ><br>
> ><br>
> ><br>
> > I want a central log server that accepts logs from multiple sources, so I<br>
> > started by trying to configure it to listen on a tcp port, I’m thinking<br>
> 514<br>
> > because we don’t use rshell anywhere, but it doesn’t really matter what<br>
> > port.<br>
> ><br>
> ><br>
> ><br>
> > The current error I’m getting is:<br>
> ><br>
> ><br>
> ><br>
> > [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start<br>
> ><br>
> > Error parsing source, source plugin network not found in<br>
> > /etc/syslog-ng/syslog-ng.conf at line 85, column 2:<br>
> ><br>
> ><br>
> ><br>
> > network(<br>
> ><br>
> > ^^^^^^^<br>
> ><br>
> ><br>
> ><br>
> > The section of the config file related to networking is below; I’ve<br>
> > commented out several attempts.<br>
> ><br>
> ><br>
> ><br>
> > # s_net = Network listener. This is listening on TCP port 514, no UDP<br>
> ><br>
> > #source s_net { tcp(port(514) max-connections(5000)); udp();};<br>
> ><br>
> ><br>
> ><br>
> > #source s_net {<br>
> ><br>
> > # tcp(ip(10.8.41.60) port(514));<br>
> ><br>
> > #};<br>
> ><br>
> ><br>
> ><br>
> > #source s_net {<br>
> ><br>
> > # network(ip(10.8.41.60) port(514));<br>
> ><br>
> > #};<br>
> ><br>
> ><br>
> ><br>
> > #source s_network {<br>
> ><br>
> > # default-network-drivers();<br>
> ><br>
> > #};<br>
> ><br>
> ><br>
> ><br>
> > #source s_syslog { syslog(<br>
> ><br>
> > # ip(10.8.41.60) port(514) transport("tcp")); };<br>
> ><br>
> ><br>
> ><br>
> > source s_network {<br>
> ><br>
> > network(<br>
> ><br>
> > ip("10.8.41.60")<br>
> ><br>
> > transport("tcp")<br>
> ><br>
> > listen-backlog(2048)<br>
> ><br>
> > );<br>
> ><br>
> > };<br>
> ><br>
> ><br>
> ><br>
> > There is a line at the top of the file:<br>
> ><br>
> > @include "scl.conf"<br>
> ><br>
> ><br>
> ><br>
> > I’ve attached the entire file.<br>
> ><br>
> ><br>
> ><br>
> > Any guidance would be very much appreciated,<br>
> ><br>
> ><br>
> ><br>
> > *Simon Tyler *| Senior Systems Administrator - PathWise Solutions Group<br>
> > Aon<br>
> > 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada<br>
> > t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724<br>
> > *<a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a> <<a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a>>*<br>
> ><br>
> > *PLEASE NOTE that my email address has changed to <a href="mailto:simon.tyler@aon.com" target="_blank">simon.tyler@aon.com</a><br>
> > <<a href="http://simon.tyler@aon.com" rel="noreferrer" target="_blank">http://simon.tyler@aon.com</a>>*<br>
> ><br>
> ><br>
> ><br>
> ><br>
> ______________________________________________________________________________<br>
> > Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> > Documentation:<br>
> > <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> > FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
> ><br>
> ><br>
> -------------- next part --------------<br>
> An HTML attachment was scrubbed...<br>
> URL: <<br>
> <a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/715578b1/attachment.html" rel="noreferrer" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/715578b1/attachment.html</a><br>
> ><br>
><br>
> ------------------------------<br>
><br>
> Subject: Digest Footer<br>
><br>
> _______________________________________________<br>
> syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
> <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
><br>
><br>
> ------------------------------<br>
><br>
> End of syslog-ng Digest, Vol 169, Issue 1<br>
> *****************************************<br>
><br>
> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation:<br>
> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
><br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190502/b6b91ca5/attachment.html" rel="noreferrer" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190502/b6b91ca5/attachment.html</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
<br>
<br>
------------------------------<br>
<br>
End of syslog-ng Digest, Vol 169, Issue 3<br>
*****************************************<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>