<div dir="ltr">Hello, <div><br></div><div>I have installed syslog-ng OSE from source on Amazon Linux 2023 distribution (as there is no EPEL available on that distribution nor are there any precompiled binaries for it)</div><div><br></div><div><div>When i start up syslog-ng in the local terminal with syslog-ng -Fedv , it runs fine forever..   But when i start it with systemd : systemctl start syslog-ng, the command times out (but does start in the background) and then it the service restarts every two minutes or so.   </div><div><br></div><div><div>I am stumped.  any thoughts?  where have i gone wrong? </div><div><br></div><div>appreciate any assistance you can offer. </div><div><br></div><div>thanks, </div><div>Darren </div><div><br></div></div></div><div><br></div><div>More information: </div><div>------------</div><div>i compiled with the following and saw no errors: </div><div><br></div><div>> ./configure --disable-smtp --disable-http --disable-python --disable-json</div><div>> make</div><div>> make install </div><div>------------</div><div>I created the systemd service file as so: </div><div><br></div><div>> cat /etc/systemd/system/syslog-ng.service</div><div>[Unit] </div><div>Description=System Logger Daemon</div><div>Documentation=man:syslog-ng(8)</div><div>After=network.target</div><div><br></div><div>[Service]</div><div>Type=notify</div><div>PIDFile=/run/syslogd.pid</div><div>ExecStart=/usr/local/sbin/syslog-ng -F -p /run/syslogd.pid</div><div>ExecReload=/bin/kill -HUP $MAINPID</div><div>StandardOutput=null</div><div>Restart=on-failure</div><div><br></div><div>[Install]</div><div>WantedBy=multi-user.target</div><div>------------<br></div><div><br></div><div>My config is here: <br>------------<br>> cat /usr/local/etc/syslog-ng.conf<br>@include âscl.confâ<br>source s_local {<br>  system();<br>  internal();<br>};<br>destination d_local {<br>  file(â/var/log/messagesâ);<br>  file(â/var/log/messages-kv.logâ template(â$ISODATE $HOST $(format-welf --scope all-nv-pairs)\nâ) frac-digits(3));<br>};<br>log {<br>  source(s_local);<br>  destination(d_local);<br>};<br>@include /etc/syslog-ng.d/*.conf<br><br>> cat /etc/syslog.d/syslognet.conf<br>options {<br>  long_hostnames(off);<br>  sync(0);<br>  keep_hostname(yes);<br>  owner(âsplunkâ);<br>  group(âsplunkâ);<br>  perm(0640);<br>  create_dirs(yes);<br>  dir_perm(0750);<br>};<br>source s_tcp_net {<br>  tcp(ip(0.0.0.0) port(41514));<br>};<br>source s_tls_net {<br>  network (<br>    ip(0.0.0.0) port(42514)<br>    transport(âtlsâ)<br>    tls(<br>      key-file(â/path/to/syslog-ng.keyâ)<br>      cert-file(â/path/to/syslog-ng.crtâ)<br>      peer-verify(no)<br>    )<br>  );<br>};<br>destination d_net {<br>  file(â/data/syslog/app/${SOURCEIP}/${YEAR}${MONTH}${DAY}-app-data.logâ);<br>};<br>log {<br>  source(s_tcp_net);<br>  source(s_tls_net);<br>  destination(d_net);<br>};<br></div><div><br></div><div>------------<br></div><div>Here is what i see when i start it with systemd:</div><div><br></div><div>> systemctl start syslog-ng</div>Job for syslog-ng.service failed because a timeout was exceeded.<br>See âsystemctl status syslog-ng.serviceâ and âjournalctl -xeu syslog-ng.serviceâ for details.<div><br></div><div>> systemctl status syslog-ng.service</div><div>  syslog-ng.service - System Logger Daemon<br>   Loaded: loaded (/etc/systemd/system/syslog-ng.service; enabled; preset: enabled)<br>   Active: activating (start) since Wed 2024-02-28 15:25:01 UTC; 35s ago<br>    Docs: man:syslog-ng(8)<br>  Main PID: 488557 (syslog-ng)<br>   Tasks: 4 (limit: 2322)<br>   Memory: 2.5M<br>    CPU: 39ms<br>   CGroup: /system.slice/syslog-ng.service<br>       ââ488557 /usr/local/sbin/syslog-ng -F -p /run/syslogd.pid<br>Feb 28 15:25:01 ip-172-31-7-110.ca-central-1.compute.internal systemd[1]: Starting syslog-ng.service - System Logger Daemon...<br><div>------------<br></div><div><br></div><div>And here is what's in /var/log/messages showing the restart: </div><div><br></div><div>> cat /var/log/messages | grep syslog-ng</div><div>Feb 28 14:38:24 ip-172-31-7-110 syslog-ng[447117]: syslog-ng shutting down; version=â4.6.0â<br>Feb 28 14:38:25 ip-172-31-7-110 syslog-ng[447177]: syslog-ng starting up; version=â4.6.0â<br>Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection accepted; fd=â26â, client=âAF_INET(1.2.3.4:27717)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection accepted; fd=â27â, client=âAF_INET(1.2.3.4:2300)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection accepted; fd=â28â, client=âAF_INET(1.2.3.4:31585)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection accepted; fd=â29â, client=âAF_INET(1.2.3.4:17761)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:39:55 ip-172-31-7-110 syslog-ng[447177]: syslog-ng shutting down; version=â4.6.0â<br>Feb 28 14:39:55 ip-172-31-7-110 syslog-ng[447234]: syslog-ng starting up; version=â4.6.0â<br>Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection accepted; fd=â25â, client=âAF_INET(1.2.3.4:7213)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection accepted; fd=â26â, client=âAF_INET(1.2.3.4:9268)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection accepted; fd=â27â, client=âAF_INET(1.2.3.4:13128)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection accepted; fd=â28â, client=âAF_INET(1.2.3.4:3928)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:41:25 ip-172-31-7-110 syslog-ng[447234]: syslog-ng shutting down; version=â4.6.0â<br>Feb 28 14:41:26 ip-172-31-7-110 syslog-ng[447385]: syslog-ng starting up; version=â4.6.0â<br>Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection accepted; fd=â25â, client=âAF_INET(1.2.3.4:1382)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection accepted; fd=â26â, client=âAF_INET(1.2.3.4:5430)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection accepted; fd=â27â, client=âAF_INET(1.2.3.4:6373)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection accepted; fd=â28â, client=âAF_INET(1.2.3.4:26287)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:42:56 ip-172-31-7-110 syslog-ng[447385]: syslog-ng shutting down; version=â4.6.0â<br>Feb 28 14:42:56 ip-172-31-7-110 syslog-ng[447443]: syslog-ng starting up; version=â4.6.0â<br>Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection accepted; fd=â25â, client=âAF_INET(1.2.3.4:15165)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection accepted; fd=â26â, client=âAF_INET(1.2.3.4:6967)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection accepted; fd=â27â, client=âAF_INET(1.2.3.4:27444)â, local=âAF_INET(0.0.0.0:41514)â<br>Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection accepted; fd=â28â, client=âAF_INET(1.2.3.4:20758)â, local=âAF_INET(0.0.0.0:41514)â</div><div><br></div><div><br></div></div></div>