<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Just for comparison this is the service file I use for syslog-ng<div class=""><br class=""></div><div class=""><pre style="background-color: rgb(255, 255, 255); color: rgb(74, 92, 110); font-family: "JetBrains Mono", monospace; font-size: 9.8pt;" class=""><span style="color: rgb(155, 112, 177);" class="">[Unit]<br class=""></span><span style="color: rgb(242, 137, 49);" class="">Description</span>=<span style="color: rgb(166, 202, 145);" class="">System Logger Daemon<br class=""></span><span style="color: rgb(242, 137, 49);" class="">Documentation</span>=<span style="color: rgb(166, 202, 145);" class="">man:syslog-ng(8)<br class=""></span><span style="color: rgb(242, 137, 49);" class="">After</span>=<span style="color: rgb(166, 202, 145);" class="">network.target network-online.target consul.service<br class=""></span><span style="color: rgb(166, 202, 145);" class=""><br class=""></span><span style="color: rgb(155, 112, 177);" class="">[Service]<br class=""></span><span style="color: rgb(242, 137, 49);" class="">Type</span>=<span style="color: rgb(166, 202, 145);" class="">forking<br class=""></span><span style="color: rgb(242, 137, 49);" class="">Environment</span>=<span style="color: rgb(166, 202, 145);" class="">SYSLOGNG_PID_FILE="/var/run/syslog-ng.pid"<br class=""></span><span style="color: rgb(242, 137, 49);" class="">Environment</span>=<span style="color: rgb(166, 202, 145);" class="">SYSLOGNG_CONF_FILE="/opt/syslog-ng/etc/syslog-ng.conf"<br class=""></span><span style="color: rgb(242, 137, 49);" class="">Environment</span>=<span style="color: rgb(166, 202, 145);" class="">SYSLOGNG_PERSIST_FILE="/opt/syslog-ng/disk-buffers/syslog-ng.persist"<br class=""></span><span style="color: rgb(242, 137, 49);" class="">Environment</span>=<span style="color: rgb(166, 202, 145);" class="">SYSLOGNG_CONTROL_FILE="/opt/syslog-ng/var/syslog-ng.ctl"<br class=""></span><span style="color: rgb(242, 137, 49);" class="">Environment</span>=<span style="color: rgb(166, 202, 145);" class="">SYSLOGNG_OPTIONS="--no-caps"<br class=""></span><span style="color: rgb(242, 137, 49);" class="">Environment</span>=<span style="color: rgb(166, 202, 145);" class="">LD_LIBRARY_PATH=/usr/lib/jvm/jre/lib/amd64/server:/usr/local/lib:$LD_LIBRARY_PATH<br class=""></span><span style="color: rgb(242, 137, 49);" class="">ExecStart</span>=<span style="color: rgb(166, 202, 145);" class="">/opt/syslog-ng/sbin/syslog-ng $SYSLOGNG_OPTIONS --cfgfile $SYSLOGNG_CONF_FILE --control $SYSLOGNG_CONTROL_FILE --persist-file $SYSLOGNG_PERSIST_FILE --pidfile $SYSLOGNG_PID_FILE<br class=""></span><span style="color: rgb(242, 137, 49);" class="">ExecReload</span>=<span style="color: rgb(166, 202, 145);" class="">/bin/kill -HUP $MAINPID<br class=""></span><span style="color: rgb(242, 137, 49);" class="">StandardOutput</span>=<span style="color: rgb(166, 202, 145);" class="">journal<br class=""></span><span style="color: rgb(242, 137, 49);" class="">StandardError</span>=<span style="color: rgb(166, 202, 145);" class="">journal<br class=""></span><span style="color: rgb(242, 137, 49);" class="">Restart</span>=<span style="color: rgb(166, 202, 145);" class="">always<br class=""></span><span style="color: rgb(166, 202, 145);" class=""><br class=""></span><span style="color: rgb(155, 112, 177);" class="">[Install]<br class=""></span><span style="color: rgb(242, 137, 49);" class="">WantedBy</span>=<span style="color: rgb(166, 202, 145);" class="">multi-user.target<br class=""></span><span style="color: rgb(242, 137, 49);" class="">Al</span></pre><div class=""><br class=""></div><div class="">If you make Type=Forking that should help since it signals to system that the process will fork then exit.</div><div class=""><br class=""></div><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="">Ronald Fenner</div><div class="">Network Architect</div><div class="">Game Circus LLC.</div></div><div class=""><br class=""></div><div class=""><a href="mailto:rfenner@gamecircus.com" class="">rfenner@gamecircus.com</a></div></div></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On Nov 19, 2020, at 2:47 PM, Laszlo Szemere (lszemere) <<a href="mailto:Laszlo.Szemere@oneidentity.com" class="">Laszlo.Szemere@oneidentity.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class="">Hello Russel,</div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class=""><br class=""></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class=""> by default, Syslog-ng spawns a supervising process and exists, which is detected by Systemd as a starting failure. Try adding the -F option to your ExecStart command.</div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class=""><br class=""></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class=""> If it not helps: as you stated correctly, most of the Systemd problems are permission or environment problems. Try adding -devt to the ExecStart command to get a more verbose output from Syslog-ng.</div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class=""><br class=""></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class=""><br class=""></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class="">Best regards,</div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class="">Laci</div><div id="appendonsend" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""></div><hr tabindex="-1" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; display: inline-block; width: 727.15625px;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class=""></span><div id="divRplyFwdMsg" dir="ltr" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><font face="Calibri, sans-serif" style="font-size: 11pt;" class=""><b class="">From:</b><span class="Apple-converted-space"> </span>syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" class="">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of Russell Fulton <<a href="mailto:r.fulton@auckland.ac.nz" class="">r.fulton@auckland.ac.nz</a>><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Thursday, November 19, 2020 21:19<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span><a href="mailto:syslog-ng@lists.balabit.hu" class="">syslog-ng@lists.balabit.hu</a><span class="Apple-converted-space"> </span><<a href="mailto:syslog-ng@lists.balabit.hu" class="">syslog-ng@lists.balabit.hu</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>[syslog-ng] issues with starting syslog-ng from systemd</font><div class=""> </div></div><div class="BodyFragment" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><font size="2" class=""><span style="font-size: 11pt;" class=""><div class="PlainText">CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.<br class=""><br class=""><br class="">version 3.26.1 — ubuntu 14.04<br class=""><br class="">I can start syslog-ng from the command line without issues (apart form a warning to stderr) but when I try and start it from systemd it starts up (it prints the warning message to the logs) and then exits silently.<br class=""><br class="">This version was compiled locally i.e. it was not installed from a package. The .service file was adapted from a sample in the contrib directory. I also had the same behaviour from and other .service file that I put together myself.<br class=""><br class="">It is presumably some to do with the environment.<br class=""><br class="">I did try starting it with -i (interactive) in the hope that it would spit something out on the console but instead it hung and I had to ^C it<br class=""><br class="">Any thoughts on how to figure out what is going on?<br class=""><br class="">=====================================<br class=""><br class="">here are two different attempts (first commented)<br class=""><br class="">rful011@secmgrprd02:~$ cat /etc/systemd/system/syslog-ng.service<br class="">#[Unit]<br class="">#Description=syslog next generation<br class="">#After=network.target auditd.service<br class=""><br class="">#[Service]<br class="">#EnvironmentFile=/etc/default/syslog-ng<br class="">#ExecStart=/usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf<br class="">#ExecReload=/usr/local/sbin/syslog-ng-ctl reload<br class="">#Restart=on-failure<br class="">#RestartPreventExitStatus=255<br class="">#Type=notify<br class=""><br class="">#[Install]<br class="">#WantedBy=multi-user.target<br class="">#Alias=syslog-ng.service<br class=""><br class=""><br class="">[Unit]<br class="">Description=System Logger Daemon<br class="">Documentation=man:syslog-ng(8)<br class="">Conflicts=emergency.service emergency.target<br class="">Wants=network.target network-online.target<br class="">After=network.target network-online.target<br class=""><br class="">[Service]<br class="">Type=notify<br class="">EnvironmentFile=-/etc/default/syslog-ng<br class="">EnvironmentFile=-/etc/sysconfig/syslog-ng<br class="">ExecStart=/usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf<br class="">ExecReload=/usr/local/sbin/syslog-ng-ctl reload<br class="">StandardOutput=journal<br class="">StandardError=journal<br class="">Restart=on-failure<br class=""><br class="">[Install]<br class="">WantedBy=multi-user.target<br class=""><br class="">______________________________________________________________________________<br class="">Member info:<span class="Apple-converted-space"> </span><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=04%7C01%7CLaszlo.Szemere%40oneidentity.com%7Ca91b88c842bd4a8a2d0608d88cc865bb%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637414139633183249%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=dr1znNjgKtRp8R3YsDn1MfSTqCSx9Y%2FKp2XRtkIl5w0%3D&reserved=0" class="">https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=04%7C01%7CLaszlo.Szemere%40oneidentity.com%7Ca91b88c842bd4a8a2d0608d88cc865bb%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637414139633183249%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=dr1znNjgKtRp8R3YsDn1MfSTqCSx9Y%2FKp2XRtkIl5w0%3D&reserved=0</a><br class="">Documentation:<span class="Apple-converted-space"> </span><a href="https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=04%7C01%7CLaszlo.Szemere%40oneidentity.com%7Ca91b88c842bd4a8a2d0608d88cc865bb%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637414139633183249%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=1aHuGKne5J%2FyTdvf7j2cpkZkKKbDkO%2B%2F2QoyTXXa1Sg%3D&reserved=0" class="">https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=04%7C01%7CLaszlo.Szemere%40oneidentity.com%7Ca91b88c842bd4a8a2d0608d88cc865bb%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637414139633183249%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=1aHuGKne5J%2FyTdvf7j2cpkZkKKbDkO%2B%2F2QoyTXXa1Sg%3D&reserved=0</a><br class="">FAQ:<span class="Apple-converted-space"> </span><a href="https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=04%7C01%7CLaszlo.Szemere%40oneidentity.com%7Ca91b88c842bd4a8a2d0608d88cc865bb%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637414139633183249%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=aDkLqXsHant5U2dUB5u4IkISQ1u0BaDdG4ItXBZBk2U%3D&reserved=0" class="">https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=04%7C01%7CLaszlo.Szemere%40oneidentity.com%7Ca91b88c842bd4a8a2d0608d88cc865bb%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637414139633183249%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=aDkLqXsHant5U2dUB5u4IkISQ1u0BaDdG4ItXBZBk2U%3D&reserved=0</a><br class=""><br class=""></div></span></font></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">______________________________________________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Member info:<span class="Apple-converted-space"> </span></span><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" style="font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Documentation:<span class="Apple-converted-space"> </span></span><a href="http://www.balabit.com/support/documentation/?product=syslog-ng" style="font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">FAQ:<span class="Apple-converted-space"> </span></span><a href="http://www.balabit.com/wiki/syslog-ng-faq" style="font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">http://www.balabit.com/wiki/syslog-ng-faq</a></div></blockquote></div><br class=""></div></body></html>