May 2018 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] hostname not appearing correctly when receiving logs from switches
by Clayton Dukes 19 Jun '18

19 Jun '18

Was anyone able to figure out why this is happening? From: "Scheidler, Balázs" <balazs.scheidler(a)balabit.com> Date: Tuesday, May 15, 2018 at 10:58 AM To: "cdukes(a)cdukes.com" <cdukes(a)cdukes.com> Cc: Clayton Dukes <cdukes(a)logzilla.net> Subject: Re: Fwd: [syslog-ng] hostname not appearing correctly when receiving logs from switches Thanks On May 15, 2018 16:52, "Clayton Dukes" <cdukes(a)gmail.com<mailto:cdukes@gmail.com>> wrote: Making sure you got this (in case the other went to spam) ______________________________________________________________ Clayton Dukes ______________________________________________________________ ---------- Forwarded message ---------- From: Clayton Dukes <cdukes(a)logzilla.net<mailto:cdukes@logzilla.net>> Date: Mon, May 7, 2018 at 4:46 PM Subject: Re: [syslog-ng] hostname not appearing correctly when receiving logs from switches To: "Scheidler, Balázs" <balazs.scheidler(a)balabit.com<mailto:balazs.scheidler@balabit.com>> Cc: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>> Hi Balazs, Sorry for the delay, I don’t get a lot of free time these days :) I have attached a pcap as well as a raw log. The log is prior to any manipulation of LogZilla rules, etc. This is easily reproduceable. Also, if I add show-timezone to the device config, the host field shows up. The problem, of course, is that we can’t tell all of our customers to re-configure all of their cisco devices. We have documented the work-around here (search the page for “hostname missing”): http://demo.logzilla.net/help/receiving_data/cisco_ios_configuration This problem never existed before, but I am not certain which syslog-ng version it started occurring in. From: "Scheidler, Balázs" <balazs.scheidler(a)balabit.com<mailto:balazs.scheidler@balabit.com>> Date: Tuesday, May 1, 2018 at 8:45 PM To: Clayton Dukes <cdukes(a)logzilla.net<mailto:cdukes@logzilla.net>> Cc: Joshua <aces621(a)yahoo.com<mailto:aces621@yahoo.com>>, Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>> Subject: Re: [syslog-ng] hostname not appearing correctly when receiving logs from switches Interesting that I saw this message the first time in your response, and not the original one. Anyhow, to understand the problem we would need an exact byte-by-byte representation of what syslog-ng is receiving from the switch together with the configuration that is used to process it. A tcpdump or an "Incoming message" from syslog debug outout should work. We haven't intentionally changed the syslog parser as far as I remember. On May 1, 2018 22:50, "Clayton Dukes" <cdukes(a)logzilla.net<mailto:cdukes@logzilla.net>> wrote: Interesting! We’ve been getting a lot of support tickets for this very problem. I can easily recreate the issue. Balabit Team: is this a new bug? [cid:image001.png@01D306E3.0FEBC990] Clayton Dukes Founder & CEO LogZilla Corporation 2900 N. Quinlan Park Rd<https://maps.google.com/?q=2900+N.+Quinlan+Park+Rd&entry=gmail&source=g>, B240-341 Austin, TX, 78732 Tel: 936-4NetOps (463-8677) Web: www.logzilla.net<http://www.logzilla.net/> [cid:image002.png@01D306E3.0FEBC990]<https://twitter.com/logzilla>[cid:image003.png@01D306E3.0FEBC990]<https://youtu.be/drg5wv_mgfA>[cid:image004.png@01D306E3.0FEBC990]<https://www.linkedin.com/in/lzcdukes/> For NetOps, By NetOps! From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu<mailto:syslog-ng-bounces@lists.balabit.hu>> on behalf of Joshua <aces621(a)yahoo.com<mailto:aces621@yahoo.com>> Reply-To: Joshua <aces621(a)yahoo.com<mailto:aces621@yahoo.com>>, Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>> Date: Monday, April 30, 2018 at 7:09 PM To: "syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>" <syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>> Subject: [Suspected Spam] [syslog-ng] hostname not appearing correctly when receiving logs from switches Hi All, I am pretty new to syslog-ng but do have some basic knowledge. I have deployed syslog-ng v3.14 on a newly deployed Linux server because syslog-ng v3.5 is working very well on another syslog server. On this new deployment, the syslogs received from most of the servers are able to show IP/host, however, the syslogs from our switches contains IP/host showing as ":" (colons). I copied the current working custom build .conf from another syslog server into our new server. Can someone help me figure out what I am missing? It is working for some components but not for switches. I tested the same switch by sending syslog to another syslog server and the hostname is appearing but just not appearing on the new syslog server. The only difference between the two server is that one uses v3.5 (the working one) and the other uses syslog-ng v3.14. I have set: "keep_hostname (yes)" but it still doesn't work. Can someone please help? Am I missing something here? Thanks Joshua Lai ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 3

syslog-ng 3.15.1 on solaris
by Szalai, Attila 31 May '18

31 May '18

Hi, We have a fairly complicated compiling system, so before I start to investigate my compiling issue I would like to ask here. Is there anybody who was able to compile 3.15.1 on solaris? (either x86 or sparc.) For me, it ended to linking process with this: ld: fatal: library -lsyslog-ng: not found collect2: error: ld returned 1 exit status libtool: install: error: relink `modules/diskq/libdisk-buffer.la' with the above command before installing it In linux, the same code compiled/linked fine. Attila Szalai Morgan Stanley | Enterprise Technology & Risk Lechner Odon fasor 8 | Floor 07 Budapest, 1095 Phone: +36 1 881-4366 Attila.Szalai(a)morganstanley.com<mailto:Attila.Szalai@morganstanley.com> Be carbon conscious. Please consider our environment before printing this email. ________________________________ NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent required and/or permitted under applicable law, to monitor electronic communications, including telephone calls with Morgan Stanley personnel. This message is subject to the Morgan Stanley General Disclaimers available at the following link: http://www.morganstanley.com/disclaimers. If you cannot access the links, please notify us by reply message and we will send the contents to you. By communicating with Morgan Stanley you acknowledge that you have read, understand and consent, (where applicable), to the foregoing and the Morgan Stanley General Disclaimers.

4 4

Re: [syslog-ng] (U) [Non-DoD Source] Re: Rotate syslog-ng log files
by Amin, Jitesh CTR DISA JSP (US) 31 May '18

31 May '18

CLASSIFICATION: UNCLASSIFIED Verion 1.6.8 Thanks Jitesh Amin CLASSIFICATION: UNCLASSIFIED -----Original Message----- From: Gergely Nagy <algernon(a)balabit.com> Sent: Wednesday, May 30, 2018 8:47 AM To: Amin, Jitesh CTR DISA JSP (US) <jitesh.amin.ctr(a)mail.mil>; Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] (U) [Non-DoD Source] Re: Rotate syslog-ng log files >>>>> "Amin" == Amin, Jitesh CTR DISA JSP (US) <jitesh.amin.ctr(a)mail.mil> writes: Amin> But now I see 2 log files in /var/log Amin> Syslog.log Amin> syslog-{YEAR}-{MONTH}-{DAY}.log Amin> Not sure why it’s creating syslog-{YEAR}-{MONTH}-{DAY}.log Amin> named file versus actually putting day/month/year in file Amin> name. Anything I missed?? What version of syslog-ng are you running? -- |8]

4 5

Re: [syslog-ng] (U) [Non-DoD Source] Re: Rotate syslog-ng log files
by Amin, Jitesh CTR DISA JSP (US) 30 May '18

30 May '18

CLASSIFICATION: UNCLASSIFIED Hello, So I updated configuration to have following in my conf file: destination syslog { file("/var/log/syslog-${YEAR}-${MONTH}-${DAY}.log"); }; and syslog-ng restarted file, But now I see 2 log files in /var/log Syslog.log syslog-{YEAR}-{MONTH}-{DAY}.log Not sure why it’s creating syslog-{YEAR}-{MONTH}-{DAY}.log named file versus actually putting day/month/year in file name. Anything I missed?? Thanks Jitesh Amin CLASSIFICATION: UNCLASSIFIED From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> On Behalf Of Scheidler, Balázs Sent: Wednesday, May 30, 2018 8:03 AM To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] (U) [Non-DoD Source] Re: Rotate syslog-ng log files All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser. _____ Yep, that would give you one logfile every day. It will not care about whether it reached 500mb though. But on the plus side that gives you a trivial way to identify which file holds a specific date, which is pretty cumbersome otherwise. On May 30, 2018 07:52, "Amin, Jitesh CTR DISA JSP (US)" <jitesh.amin.ctr(a)mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > > wrote: CLASSIFICATION: UNCLASSIFIED Hello, So here's what currently is configured in our .conf file: destination syslog { file("/var/log/syslog.log" perm(0644)); }; what you are saying, is if I want logs to rotate on daily basis, I can just make the above line to read as following: destination syslog { file("/var/log/syslog-${YEAR}-${MONTH}-${DAY}.log"); }; Thanks Jitesh Amin CLASSIFICATION: UNCLASSIFIED -----Original Message----- From: Gergely Nagy <algernon(a)balabit.com < Caution-mailto:algernon@balabit.com > > Sent: Wednesday, May 30, 2018 7:25 AM To: Amin, Jitesh CTR DISA JSP (US) <jitesh.amin.ctr(a)mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > >; syslog-ng(a)lists.balabit.hu < Caution-mailto:syslog-ng@lists.balabit.hu > Subject: [Non-DoD Source] Re: [syslog-ng] (U) Rotate syslog-ng log files All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser. ---- Hi! >>>>> "Amin" == Amin, Jitesh CTR DISA JSP (US) <jitesh.amin.ctr(a)mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > > writes: Amin> What we are trying to do is rotate the syslog.log file once it Amin> reaches 500 MB (as well as looking into rotating file every 24 Amin> hours)? Once the log file rotates, it creates a new file named Amin> syslog.log.0 and so on.. syslog-ng does not support size-based rotation, you'll have to configure logrotate for that. See the packaging/debian/syslog-ng-core.syslog-ng.logrotate[1] file for an example. [1]: Caution-Caution-https://github.com/balabit/syslog-ng/blob/master/packaging/… < Caution-https://github.com/balabit/syslog-ng/blob/master/packaging/debian/s… > With logrotate, the most recent logfile syslog-ng writes to will always be syslog.log, and the rotated files will have different names - depending on the logrotate configuration you use. For time-based, daily rotation, you can use templates in the destination filename, such as: destination d_syslog { file("/var/log/syslog-${YEAR}-${MONTH}-${DAY}.log"); }; Hope this helps! -- |8] ______________________________________________________________________________ Member info: Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng < Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: Caution-http://www.balabit.com/support/documentation/?product=syslog-ng < Caution-http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: Caution-http://www.balabit.com/wiki/syslog-ng-faq < Caution-http://www.balabit.com/wiki/syslog-ng-faq >

2 1

Re: [syslog-ng] (U) [Non-DoD Source] Re: Rotate syslog-ng log files
by Amin, Jitesh CTR DISA JSP (US) 30 May '18

30 May '18

CLASSIFICATION: UNCLASSIFIED Hello, So here's what currently is configured in our .conf file: destination syslog { file("/var/log/syslog.log" perm(0644)); }; what you are saying, is if I want logs to rotate on daily basis, I can just make the above line to read as following: destination syslog { file("/var/log/syslog-${YEAR}-${MONTH}-${DAY}.log"); }; Thanks Jitesh Amin CLASSIFICATION: UNCLASSIFIED -----Original Message----- From: Gergely Nagy <algernon(a)balabit.com> Sent: Wednesday, May 30, 2018 7:25 AM To: Amin, Jitesh CTR DISA JSP (US) <jitesh.amin.ctr(a)mail.mil>; syslog-ng(a)lists.balabit.hu Subject: [Non-DoD Source] Re: [syslog-ng] (U) Rotate syslog-ng log files All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser. ---- Hi! >>>>> "Amin" == Amin, Jitesh CTR DISA JSP (US) <jitesh.amin.ctr(a)mail.mil> writes: Amin> What we are trying to do is rotate the syslog.log file once it Amin> reaches 500 MB (as well as looking into rotating file every 24 Amin> hours)? Once the log file rotates, it creates a new file named Amin> syslog.log.0 and so on.. syslog-ng does not support size-based rotation, you'll have to configure logrotate for that. See the packaging/debian/syslog-ng-core.syslog-ng.logrotate[1] file for an example. [1]: Caution-https://github.com/balabit/syslog-ng/blob/master/packaging/debian/s… With logrotate, the most recent logfile syslog-ng writes to will always be syslog.log, and the rotated files will have different names - depending on the logrotate configuration you use. For time-based, daily rotation, you can use templates in the destination filename, such as: destination d_syslog { file("/var/log/syslog-${YEAR}-${MONTH}-${DAY}.log"); }; Hope this helps! -- |8]

2 1

(U) Rotate syslog-ng log files
by Amin, Jitesh CTR DISA JSP (US) 30 May '18

30 May '18

CLASSIFICATION: UNCLASSIFIED Hello, Currently we have syslog writing a single file (syslog.log) that just grows exponentially? What we are trying to do is rotate the syslog.log file once it reaches 500 MB (as well as looking into rotating file every 24 hours)? Once the log file rotates, it creates a new file named syslog.log.0 and so on.. Can someone please tell me how do I go about doing so and what specific configuration I need to have it in place in syslog-ng.conf file to achieve this? Thanks Jitesh Amin CLASSIFICATION: UNCLASSIFIED

2 1

Java issue with elasticsearch
by Komi Elitcha 28 May '18

28 May '18

Good day all, I'm new to this mailing list. I'm setting up syslong-ng+elasticsearch+kibana on an Ubuntu 18.04; i'm getting the following output/error from command: ]#syslog-ng -Fve Error parsing destination, destination plugin java not found in block destination elasticsearch2 (at /usr/share/syslog-ng/include/scl/elasticsearch/plugin.conf:58:1): 1 2-----> java( 2-----> ^^^^ 3 class_path("/usr/lib/syslog-ng/3.15/java-modules/*.jar:/usr/lib/syslog-ng/3.15/java-modules/elastic-jest-client/*.jar:/opt/syslog-ng/jre1.8.0_171/lib//*.jar") 4 class_name("org.syslog_ng.elasticsearch_v2.ElasticSearchDestination") 5 option("index", "*log*") 6 option("type", "syslog") 7 option("server", "localhost") Included from /etc/syslog-ng/syslog-ng.conf: 90 # Debian only 91 destination d_ppp { file("/var/log/ppp.log"); }; 92 93 # Elasticsearch destination 94 destination d_es { 95----> elasticsearch2( 95----> ^^^^^^^^^^^^^^^^ 96 cluster("syslog-ng") 97 client-lib-dir("/usr/share/elasticsearch/lib/") 98 client-lib-dir("/opt/syslog-ng/jre1.8.0_171/lib/") 99 time-zone("UTC") 100 cluster-url("http://localhost:9200") Any help is welcome. Thanks.

5 11

Re: [syslog-ng] Unbale to mount syslog-ng.conf to /etc/syslog-ng using docker image
by László Várady 27 May '18

27 May '18

Hi, Thanks. It might be possible that you have SELinux enabled on your system. Give it another try using the :Z flag: docker run -it -v /demo/syslog-ng/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf*:Z* --name syslog-ng -p 514:514 -p 601:601 balabit/syslog-ng:latest Please note that you are using the latest edge version of Docker with the devicemapper storage engine. It has nothing to do with your issue, but I would consider switching to the stable version (with overlay2). https://docs.docker.com/install/linux/docker-ce/centos/ -- László Várady On Sun, May 27, 2018 at 12:56 PM Mujeeb Baig <baig.mujeeb(a)gmail.com> wrote: > Hi, > > Docker info output > > root@hdata3:/home/smb/code/conf# docker info > Containers: 0 > Running: 0 > Paused: 0 > Stopped: 0 > Images: 0 > Server Version: 18.05.0-ce > Storage Driver: devicemapper > Pool Name: docker-8:1-100670142-pool > Pool Blocksize: 65.54kB > Base Device Size: 10.74GB > Backing Filesystem: xfs > Udev Sync Supported: true > Data file: /dev/loop0 > Metadata file: /dev/loop1 > Data loop file: /var/lib/docker/devicemapper/devicemapper/data > Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata > Data Space Used: 11.73MB > Data Space Total: 107.4GB > Data Space Available: 51.36GB > Metadata Space Used: 581.6kB > Metadata Space Total: 2.147GB > Metadata Space Available: 2.147GB > Thin Pool Minimum Free Space: 10.74GB > Deferred Removal Enabled: true > Deferred Deletion Enabled: true > Deferred Deleted Device Count: 0 > Library Version: 1.02.146-RHEL7 (2018-01-22) > Logging Driver: json-file > Cgroup Driver: cgroupfs > Plugins: > Volume: local > Network: bridge host macvlan null overlay > Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk > syslog > Swarm: inactive > Runtimes: runc > Default Runtime: runc > Init Binary: docker-init > containerd version: 773c489c9c1b21a6d78b5c538cd395416ec50f88 > runc version: 4fc53a81fb7c994640722ac585fa9ca548971871 > init version: 949e6fa > Security Options: > seccomp > Profile: default > Kernel Version: 3.10.0-693.21.1.el7.x86_64 > Operating System: CentOS Linux 7 (Core) > OSType: linux > Architecture: x86_64 > CPUs: 2 > Total Memory: 7.147GiB > Name: api-es-syslog-ng-2 > ID: HOBZ:AVPN:MRVO:JAMW:YZFU:SF5M:LTFF:7H7Y:BKBA:MNV4:OMY3:4IJM > Docker Root Dir: /var/lib/docker > Debug Mode (client): false > Debug Mode (server): false > Registry: https://index.docker.io/v1/ > Labels: > provider=google > Experimental: false > Insecure Registries: > 127.0.0.0/8 > Live Restore Enabled: false > > WARNING: devicemapper: usage of loopback devices is strongly discouraged > for production use. > Use `--storage-opt dm.thinpooldev` to specify a custom block > storage device. > > > On 25 May 2018 at 18:21, László Várady <laszlo.varady(a)balabit.com> wrote: > >> Hi, >> >> Thanks. >> >> Could you share what version of Docker you are using? >> The output of "docker version" and "docker info" might be interesting. >> >> -- >> László Várady >> >> On Fri, May 25, 2018 at 6:41 PM Mujeeb Baig <baig.mujeeb(a)gmail.com> >> wrote: >> >>> Hi Laci >>> >>> Here is the output, this time I created another folder /demo/syslog-ng >>> and copied the syslog-ng.conf file there, but same issue. I had also >>> attached the output of >>> docker volume inspect syslog-ng (see attcahment) >>> By the way thanks for your help so far. >>> >>> root@hdata3:/home/smb/code/conf# docker rmi balabit/syslog-ng:latest >>> Untagged: balabit/syslog-ng:latest >>> Untagged: balabit/syslog-ng@sha256 >>> :55ed29d3f68e6ce5c0494580af0b49bdfbbd83232902d9db0596486dbc2f0d3f >>> Deleted: >>> sha256:aea40146388e85ca11d2b8b4ee7877d2939a71bed41b727431d48b21084967e1 >>> Deleted: >>> sha256:b97aefa7a738770d348b4c7b5ba8d6cfcaada9453e41603db7b57b01a6bf6773 >>> Deleted: >>> sha256:11aa7498ed3edbf74eea2ee5de418fb8789055e278e750d1db5e4fe9057cada4 >>> Deleted: >>> sha256:a15ea7dac472320a77dfffe1066680e7dfd46eea735376a5b8a2040f4d0ca57e >>> Deleted: >>> sha256:f2f7b467bea911acac35d8a24c3b14cf163bb00370209f5214e5950813d45686 >>> Deleted: >>> sha256:42a1952fea491565f3b8fb19d5869576c8d12a9192f867c4b72234349fa9059a >>> Deleted: >>> sha256:e30891f348eea2928d4027527455904b5933426cbbef4be4b9a908c97a09ba68 >>> Deleted: >>> sha256:ffc4c11463ee21b7532b63abd6079393c619a5d0f4b00397a4b9d1cf9efc4d9b >>> root@hdata3:/home/smb/code/conf# >>> root@hdata3:/home/smb/code/conf# docker pull balabit/syslog-ng >>> Using default tag: latest >>> latest: Pulling from balabit/syslog-ng >>> 4176fe04cefe: Pull complete >>> af68cba418f8: Pull complete >>> 9b2b4fba2935: Pull complete >>> 6297af76ec77: Pull complete >>> 7bf2bd8c0da2: Pull complete >>> 85f1f826e469: Pull complete >>> 24a506d1872d: Pull complete >>> Digest: >>> sha256:55ed29d3f68e6ce5c0494580af0b49bdfbbd83232902d9db0596486dbc2f0d3f >>> Status: Downloaded newer image for balabit/syslog-ng:latest >>> root@hdata3:/home/smb/code/conf# >>> root@hdata3:/home/smb/code/conf# >>> root@hdata3:/home/smb/code/conf# docker run -it -v >>> /demo/syslog-ng/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf --name >>> syslog-ng -p 514:514 -p 601:601 balabit/syslog-ng:latest >>> docker: Error response from daemon: OCI runtime create failed: >>> container_linux.go:348: starting container process caused >>> "process_linux.go:402: container init caused \"rootfs_linux.go:58: mounting >>> \\\"/demo/syslog-ng/syslog-ng.conf\\\" to rootfs >>> \\\"/var/lib/docker/devicemapper/mnt/4751fd8ef1ddb782156a57749429486610b6c3d532a77c6ebf0727ca72ea451a/rootfs\\\" >>> at >>> \\\"/var/lib/docker/devicemapper/mnt/4751fd8ef1ddb782156a57749429486610b6c3d532a77c6ebf0727ca72ea451a/rootfs/etc/syslog-ng/syslog-ng.conf\\\" >>> caused \\\"not a directory\\\"\"": unknown: Are you trying to mount a >>> directory onto a file (or vice-versa)? Check if the specified host path >>> exists and is the expected type. >>> root@hdata3:/home/smb/code/conf# >>> root@hdata3:/home/smb/code/conf# docker volume ls >>> DRIVER VOLUME NAME >>> root@hdata3:/home/smb/code/conf# >>> >>> >>> On 25 May 2018 at 17:01, László Várady <laszlo.varady(a)balabit.com> >>> wrote: >>> >>>> Hi Mujeeb, >>>> >>>> Something weird happened when you executed >>>> >>>> docker run -it -v "$PWD"/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf >>>> --name syslog-ng -p 514:514 -p 601:601 balabit/syslog-ng:latest >>>> >>>> for the first time, so I would like to ask you to start from a clean >>>> environment. >>>> >>>> - You've made sure that /home/smb/code/conf/syslog-ng.conf exists on >>>> your host and it is a file. >>>> >>>> - In the original balabit/syslog-ng image, >>>> /etc/syslog-ng/syslog-ng.conf is also a file, so the mount should work. >>>> >>>> Please run the following commands: >>>> >>>> 1. docker rm syslog-ng >>>> >>>> 2. docker rmi balabit/syslog-ng >>>> >>>> 3. docker pull balabit/syslog-ng >>>> >>>> And finally, what you actually wanted to run: >>>> >>>> 4. docker run -it -v /home/smb/code/conf/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf >>>> --name syslog-ng -p 514:514 -p 601:601 balabit/syslog-ng:latest >>>> >>>> If you still experience problems after this, please send us the output >>>> of "docker volume ls". >>>> >>>> One more question: >>>> Is it possible that "/home/smb/code/conf/" is a mounted network >>>> filesystem (NFS, SMB)? >>>> >>>> -- >>>> László Várady >>>> >>>> On Fri, May 25, 2018 at 5:33 PM Mujeeb Baig <baig.mujeeb(a)gmail.com> >>>> wrote: >>>> >>>>> Hi Laci, >>>>> >>>>> It runs fine >>>>> root@hdata3:/home/smb/code/conf# file >>>>> /home/smb/code/conf/syslog-ng.conf >>>>> /home/smb/code/conf/syslog-ng.conf: ASCII text >>>>> >>>>> Regards >>>>> Mujeeb >>>>> >>>>> On 25 May 2018 at 16:20, Szemere, László <laszlo.szemere(a)balabit.com> >>>>> wrote: >>>>> >>>>>> Hello, >>>>>> >>>>>> Thank you for the output. Can you run the >>>>>> >>>>>> *file /home/smb/code/conf/syslog-ng.conf* >>>>>> >>>>>> command on your HOST machine? >>>>>> >>>>>> >>>>>> Br, >>>>>> Laci >>>>>> >>>>>> >>>>>> On Fri, May 25, 2018 at 5:04 PM, Mujeeb Baig <baig.mujeeb(a)gmail.com> >>>>>> wrote: >>>>>> >>>>>>> It is locating the source correctly, this is what I see under >>>>>>> 'Mounts' section of inspect >>>>>>> >>>>>>> "Mounts": [ >>>>>>> { >>>>>>> "Type": "bind", >>>>>>> "Source": "/home/smb/code/conf/syslog-ng.conf", >>>>>>> "Destination": "/1234", >>>>>>> "Mode": "", >>>>>>> "RW": true, >>>>>>> "Propagation": "rprivate" >>>>>>> } >>>>>>> ], >>>>>>> >>>>>>> >>>>>>> On 25 May 2018 at 15:57, Szemere, László <laszlo.szemere(a)balabit.com >>>>>>> > wrote: >>>>>>> >>>>>>>> Hello, >>>>>>>> >>>>>>>> From the Docker documentation: >>>>>>>> https://docs.docker.com/v17.09/engine/admin/volumes/bind-mounts/#difference… >>>>>>>> >>>>>>>> If you use -v or --volume to bind-mount a file or directory that >>>>>>>>> does not yet exist on the Docker host, -v will create the >>>>>>>>> endpoint for you. >>>>>>>>> *It is always created as a directory.*If you use --mount to >>>>>>>>> bind-mount a file or directory that does not yet exist on the Docker host, >>>>>>>>> Docker does *not* automatically create it for you, but generates >>>>>>>>> an error. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> It looks like docker daemon still can not find your file >>>>>>>> *"$PWD"/syslog-ng.conf* and creates a directory instead. >>>>>>>> Instead of heavy debugging, I suggest to run *docker inspect >>>>>>>> syslog-ng* to see what path was actually mounted by the docker >>>>>>>> daemon. You should see something like this in the output: >>>>>>>> >>>>>>>> "Mounts": [ >>>>>>>>> { >>>>>>>>> "Type": "bind", >>>>>>>>> "Source": "XXX/syslog-ng.conf", >>>>>>>>> "Destination": "/1234", >>>>>>>>> "Mode": "", >>>>>>>>> "RW": true, >>>>>>>>> "Propagation": "rprivate" >>>>>>>>> } >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Once we have the actual mounted path, it will be easier to figure >>>>>>>> out why the docker daemon can not find your original config file. >>>>>>>> >>>>>>>> Br, >>>>>>>> Laci >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Fri, May 25, 2018 at 4:19 PM, Mujeeb Baig <baig.mujeeb(a)gmail.com >>>>>>>> > wrote: >>>>>>>> >>>>>>>>> Hi Andrew, >>>>>>>>> >>>>>>>>> Thanks for your response. Yes the path is correct >>>>>>>>> >>>>>>>>> When I execute with host location as /1234 it creates the >>>>>>>>> container, but nothing inside /1234 folder >>>>>>>>> >>>>>>>>> root@hdata3:/home/smb/code/conf# docker run -it -v >>>>>>>>> "$PWD"/syslog-ng.conf:/1234 --name syslog-ng -p 514:514 -p 601:601 >>>>>>>>> balabit/syslog-ng:latest >>>>>>>>> syslog-ng: Error setting capabilities, capability management >>>>>>>>> disabled; error='Operation not permitted' >>>>>>>>> [2018-05-25T14:12:15.695588] WARNING: Configuration file format is >>>>>>>>> too old, syslog-ng is running in compatibility mode. Please update it to >>>>>>>>> use the syslog-ng 3.14 format at your time of convenience. To upgrade the >>>>>>>>> configuration, please review the warnings about incompatible changes >>>>>>>>> printed by syslog-ng, and once completed change the @version header at the >>>>>>>>> top of the configuration file.; >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> I can see inside the container that /etc/syslog-ng/ this folder >>>>>>>>> is not updated >>>>>>>>> >>>>>>>>> root@hdata3:/home/smb# docker exec -ti syslog-ng /bin/bash >>>>>>>>> root@d634d32aee4c:/# >>>>>>>>> root@d634d32aee4c:/# ls -l /1234/ >>>>>>>>> total 0 >>>>>>>>> root@d634d32aee4c:/# >>>>>>>>> root@d634d32aee4c:/# ls -l /sy/etcslog-ng/ >>>>>>>>> conf.d/ patterndb.d/ scl.conf syslog-ng.conf >>>>>>>>> root@d634d32aee4c:/# ls -lrt /etc/syslog-ng/ >>>>>>>>> total 12 >>>>>>>>> -rw-r--r--. 1 root root 5910 Feb 23 13:17 syslog-ng.conf >>>>>>>>> drwxr-xr-x. 2 root root 6 Mar 2 12:58 conf.d >>>>>>>>> drwxr-xr-x. 2 root root 6 Mar 2 12:58 patterndb.d >>>>>>>>> -rw-r--r--. 1 root root 1336 Mar 2 12:58 scl.conf >>>>>>>>> root@d634d32aee4c:/# >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On 25 May 2018 at 13:31, Mitzki, András <andras.mitzki(a)balabit.com >>>>>>>>> > wrote: >>>>>>>>> >>>>>>>>>> Hi Mujeeb, >>>>>>>>>> >>>>>>>>>> Maybe the problem is with the config file path: >>>>>>>>>> "/home/smb/code/conf/syslog-ng.conf" >>>>>>>>>> Could you check that path is correct? >>>>>>>>>> >>>>>>>>>> Regards >>>>>>>>>> Andrew >>>>>>>>>> >>>>>>>>>> On Fri, May 25, 2018 at 1:13 PM, Mujeeb Baig < >>>>>>>>>> baig.mujeeb(a)gmail.com> wrote: >>>>>>>>>> >>>>>>>>>>> Hi >>>>>>>>>>> >>>>>>>>>>> This is my first trial of syslog-ng. I've tried to start >>>>>>>>>>> syslog-ng just like described on the official bolg page >>>>>>>>>>> https://syslog-ng.com/blog/central-log-server-docker/ >>>>>>>>>>> https://syslog-ng.com/blog/collecting-docker-infrastructure-logs-using-sysl… >>>>>>>>>>> >>>>>>>>>>> I am starting docker container as: >>>>>>>>>>> >>>>>>>>>>> docker run -it -v >>>>>>>>>>> "$PWD"/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf --name syslog-ng -p >>>>>>>>>>> 514:514 -p 601:601 balabit/syslog-ng:latest >>>>>>>>>>> >>>>>>>>>>> But unfortunately it is failing to mount my custom (local) >>>>>>>>>>> configuration file from source to host, complaining about mounting a >>>>>>>>>>> directory onto file >>>>>>>>>>> >>>>>>>>>>> Error: >>>>>>>>>>> >>>>>>>>>>> docker: Error response from daemon: OCI runtime create failed: >>>>>>>>>>> container_linux.go:348: starting container process caused >>>>>>>>>>> "process_linux.go:402: container init caused \"rootfs_linux.go:58: mounting >>>>>>>>>>> \\"/home/smb/code/conf/syslog-ng.conf\\" to rootfs >>>>>>>>>>> \\"/var/lib/docker/devicemapper/mnt/52d32f854a030b396b03e7596ab5d71eb1a18f34a09d5e4997c437568749b259/rootfs\\" >>>>>>>>>>> at >>>>>>>>>>> \\"/var/lib/docker/devicemapper/mnt/52d32f854a030b396b03e7596ab5d71eb1a18f34a09d5e4997c437568749b259/rootfs/etc/syslog-ng/syslog-ng.conf\\" >>>>>>>>>>> caused \\"not a directory\\"\"": unknown: Are you trying to mount a >>>>>>>>>>> directory onto a file (or vice-versa)? Check if the specified host path >>>>>>>>>>> exists and is the expected type. >>>>>>>>>>> >>>>>>>>>>> Am I missing something? >>>>>>>>>>> >>>>>>>>>>> Please let me know >>>>>>>>>>> >>>>>>>>>>> Many Thanks >>>>>>>>>>> >>>>>>>>>>> Mujeeb >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> ______________________________________________________________________________ >>>>>>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>>>>>> Documentation: >>>>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> ______________________________________________________________________________ >>>>>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>>>>> Documentation: >>>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> ______________________________________________________________________________ >>>>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>>>> Documentation: >>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> ______________________________________________________________________________ >>>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>>> Documentation: >>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> >>>>>>> >>>>>>> ______________________________________________________________________________ >>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>> Documentation: >>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>> >>>>>> ______________________________________________________________________________ >>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>> Documentation: >>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>> >>>>>> >>>>>> >>>>> >>>>> ______________________________________________________________________________ >>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>> Documentation: >>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>> >>>>> >>> >

1 0

Re: [syslog-ng] Unbale to mount syslog-ng.conf to /etc/syslog-ng using docker image
by László Várady 25 May '18

25 May '18

Hi, Thanks. Could you share what version of Docker you are using? The output of "docker version" and "docker info" might be interesting. -- László Várady On Fri, May 25, 2018 at 6:41 PM Mujeeb Baig <baig.mujeeb(a)gmail.com> wrote: > Hi Laci > > Here is the output, this time I created another folder /demo/syslog-ng and > copied the syslog-ng.conf file there, but same issue. I had also attached > the output of > docker volume inspect syslog-ng (see attcahment) > By the way thanks for your help so far. > > root@hdata3:/home/smb/code/conf# docker rmi balabit/syslog-ng:latest > Untagged: balabit/syslog-ng:latest > Untagged: balabit/syslog-ng@sha256 > :55ed29d3f68e6ce5c0494580af0b49bdfbbd83232902d9db0596486dbc2f0d3f > Deleted: > sha256:aea40146388e85ca11d2b8b4ee7877d2939a71bed41b727431d48b21084967e1 > Deleted: > sha256:b97aefa7a738770d348b4c7b5ba8d6cfcaada9453e41603db7b57b01a6bf6773 > Deleted: > sha256:11aa7498ed3edbf74eea2ee5de418fb8789055e278e750d1db5e4fe9057cada4 > Deleted: > sha256:a15ea7dac472320a77dfffe1066680e7dfd46eea735376a5b8a2040f4d0ca57e > Deleted: > sha256:f2f7b467bea911acac35d8a24c3b14cf163bb00370209f5214e5950813d45686 > Deleted: > sha256:42a1952fea491565f3b8fb19d5869576c8d12a9192f867c4b72234349fa9059a > Deleted: > sha256:e30891f348eea2928d4027527455904b5933426cbbef4be4b9a908c97a09ba68 > Deleted: > sha256:ffc4c11463ee21b7532b63abd6079393c619a5d0f4b00397a4b9d1cf9efc4d9b > root@hdata3:/home/smb/code/conf# > root@hdata3:/home/smb/code/conf# docker pull balabit/syslog-ng > Using default tag: latest > latest: Pulling from balabit/syslog-ng > 4176fe04cefe: Pull complete > af68cba418f8: Pull complete > 9b2b4fba2935: Pull complete > 6297af76ec77: Pull complete > 7bf2bd8c0da2: Pull complete > 85f1f826e469: Pull complete > 24a506d1872d: Pull complete > Digest: > sha256:55ed29d3f68e6ce5c0494580af0b49bdfbbd83232902d9db0596486dbc2f0d3f > Status: Downloaded newer image for balabit/syslog-ng:latest > root@hdata3:/home/smb/code/conf# > root@hdata3:/home/smb/code/conf# > root@hdata3:/home/smb/code/conf# docker run -it -v > /demo/syslog-ng/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf --name > syslog-ng -p 514:514 -p 601:601 balabit/syslog-ng:latest > docker: Error response from daemon: OCI runtime create failed: > container_linux.go:348: starting container process caused > "process_linux.go:402: container init caused \"rootfs_linux.go:58: mounting > \\\"/demo/syslog-ng/syslog-ng.conf\\\" to rootfs > \\\"/var/lib/docker/devicemapper/mnt/4751fd8ef1ddb782156a57749429486610b6c3d532a77c6ebf0727ca72ea451a/rootfs\\\" > at > \\\"/var/lib/docker/devicemapper/mnt/4751fd8ef1ddb782156a57749429486610b6c3d532a77c6ebf0727ca72ea451a/rootfs/etc/syslog-ng/syslog-ng.conf\\\" > caused \\\"not a directory\\\"\"": unknown: Are you trying to mount a > directory onto a file (or vice-versa)? Check if the specified host path > exists and is the expected type. > root@hdata3:/home/smb/code/conf# > root@hdata3:/home/smb/code/conf# docker volume ls > DRIVER VOLUME NAME > root@hdata3:/home/smb/code/conf# > > > On 25 May 2018 at 17:01, László Várady <laszlo.varady(a)balabit.com> wrote: > >> Hi Mujeeb, >> >> Something weird happened when you executed >> >> docker run -it -v "$PWD"/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf >> --name syslog-ng -p 514:514 -p 601:601 balabit/syslog-ng:latest >> >> for the first time, so I would like to ask you to start from a clean >> environment. >> >> - You've made sure that /home/smb/code/conf/syslog-ng.conf exists on your >> host and it is a file. >> >> - In the original balabit/syslog-ng image, /etc/syslog-ng/syslog-ng.conf >> is also a file, so the mount should work. >> >> Please run the following commands: >> >> 1. docker rm syslog-ng >> >> 2. docker rmi balabit/syslog-ng >> >> 3. docker pull balabit/syslog-ng >> >> And finally, what you actually wanted to run: >> >> 4. docker run -it -v /home/smb/code/conf/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf >> --name syslog-ng -p 514:514 -p 601:601 balabit/syslog-ng:latest >> >> If you still experience problems after this, please send us the output of >> "docker volume ls". >> >> One more question: >> Is it possible that "/home/smb/code/conf/" is a mounted network >> filesystem (NFS, SMB)? >> >> -- >> László Várady >> >> On Fri, May 25, 2018 at 5:33 PM Mujeeb Baig <baig.mujeeb(a)gmail.com> >> wrote: >> >>> Hi Laci, >>> >>> It runs fine >>> root@hdata3:/home/smb/code/conf# file /home/smb/code/conf/syslog-ng.conf >>> /home/smb/code/conf/syslog-ng.conf: ASCII text >>> >>> Regards >>> Mujeeb >>> >>> On 25 May 2018 at 16:20, Szemere, László <laszlo.szemere(a)balabit.com> >>> wrote: >>> >>>> Hello, >>>> >>>> Thank you for the output. Can you run the >>>> >>>> *file /home/smb/code/conf/syslog-ng.conf* >>>> >>>> command on your HOST machine? >>>> >>>> >>>> Br, >>>> Laci >>>> >>>> >>>> On Fri, May 25, 2018 at 5:04 PM, Mujeeb Baig <baig.mujeeb(a)gmail.com> >>>> wrote: >>>> >>>>> It is locating the source correctly, this is what I see under 'Mounts' >>>>> section of inspect >>>>> >>>>> "Mounts": [ >>>>> { >>>>> "Type": "bind", >>>>> "Source": "/home/smb/code/conf/syslog-ng.conf", >>>>> "Destination": "/1234", >>>>> "Mode": "", >>>>> "RW": true, >>>>> "Propagation": "rprivate" >>>>> } >>>>> ], >>>>> >>>>> >>>>> On 25 May 2018 at 15:57, Szemere, László <laszlo.szemere(a)balabit.com> >>>>> wrote: >>>>> >>>>>> Hello, >>>>>> >>>>>> From the Docker documentation: >>>>>> https://docs.docker.com/v17.09/engine/admin/volumes/bind-mounts/#difference… >>>>>> >>>>>> If you use -v or --volume to bind-mount a file or directory that >>>>>>> does not yet exist on the Docker host, -v will create the endpoint >>>>>>> for you. >>>>>>> *It is always created as a directory.*If you use --mount to >>>>>>> bind-mount a file or directory that does not yet exist on the Docker host, >>>>>>> Docker does *not* automatically create it for you, but generates an >>>>>>> error. >>>>>> >>>>>> >>>>>> >>>>>> It looks like docker daemon still can not find your file >>>>>> *"$PWD"/syslog-ng.conf* and creates a directory instead. >>>>>> Instead of heavy debugging, I suggest to run *docker inspect >>>>>> syslog-ng* to see what path was actually mounted by the docker >>>>>> daemon. You should see something like this in the output: >>>>>> >>>>>> "Mounts": [ >>>>>>> { >>>>>>> "Type": "bind", >>>>>>> "Source": "XXX/syslog-ng.conf", >>>>>>> "Destination": "/1234", >>>>>>> "Mode": "", >>>>>>> "RW": true, >>>>>>> "Propagation": "rprivate" >>>>>>> } >>>>>> >>>>>> >>>>>> >>>>>> Once we have the actual mounted path, it will be easier to figure >>>>>> out why the docker daemon can not find your original config file. >>>>>> >>>>>> Br, >>>>>> Laci >>>>>> >>>>>> >>>>>> >>>>>> On Fri, May 25, 2018 at 4:19 PM, Mujeeb Baig <baig.mujeeb(a)gmail.com> >>>>>> wrote: >>>>>> >>>>>>> Hi Andrew, >>>>>>> >>>>>>> Thanks for your response. Yes the path is correct >>>>>>> >>>>>>> When I execute with host location as /1234 it creates the container, >>>>>>> but nothing inside /1234 folder >>>>>>> >>>>>>> root@hdata3:/home/smb/code/conf# docker run -it -v >>>>>>> "$PWD"/syslog-ng.conf:/1234 --name syslog-ng -p 514:514 -p 601:601 >>>>>>> balabit/syslog-ng:latest >>>>>>> syslog-ng: Error setting capabilities, capability management >>>>>>> disabled; error='Operation not permitted' >>>>>>> [2018-05-25T14:12:15.695588] WARNING: Configuration file format is >>>>>>> too old, syslog-ng is running in compatibility mode. Please update it to >>>>>>> use the syslog-ng 3.14 format at your time of convenience. To upgrade the >>>>>>> configuration, please review the warnings about incompatible changes >>>>>>> printed by syslog-ng, and once completed change the @version header at the >>>>>>> top of the configuration file.; >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> I can see inside the container that /etc/syslog-ng/ this folder is >>>>>>> not updated >>>>>>> >>>>>>> root@hdata3:/home/smb# docker exec -ti syslog-ng /bin/bash >>>>>>> root@d634d32aee4c:/# >>>>>>> root@d634d32aee4c:/# ls -l /1234/ >>>>>>> total 0 >>>>>>> root@d634d32aee4c:/# >>>>>>> root@d634d32aee4c:/# ls -l /sy/etcslog-ng/ >>>>>>> conf.d/ patterndb.d/ scl.conf syslog-ng.conf >>>>>>> root@d634d32aee4c:/# ls -lrt /etc/syslog-ng/ >>>>>>> total 12 >>>>>>> -rw-r--r--. 1 root root 5910 Feb 23 13:17 syslog-ng.conf >>>>>>> drwxr-xr-x. 2 root root 6 Mar 2 12:58 conf.d >>>>>>> drwxr-xr-x. 2 root root 6 Mar 2 12:58 patterndb.d >>>>>>> -rw-r--r--. 1 root root 1336 Mar 2 12:58 scl.conf >>>>>>> root@d634d32aee4c:/# >>>>>>> >>>>>>> >>>>>>> >>>>>>> On 25 May 2018 at 13:31, Mitzki, András <andras.mitzki(a)balabit.com> >>>>>>> wrote: >>>>>>> >>>>>>>> Hi Mujeeb, >>>>>>>> >>>>>>>> Maybe the problem is with the config file path: >>>>>>>> "/home/smb/code/conf/syslog-ng.conf" >>>>>>>> Could you check that path is correct? >>>>>>>> >>>>>>>> Regards >>>>>>>> Andrew >>>>>>>> >>>>>>>> On Fri, May 25, 2018 at 1:13 PM, Mujeeb Baig <baig.mujeeb(a)gmail.com >>>>>>>> > wrote: >>>>>>>> >>>>>>>>> Hi >>>>>>>>> >>>>>>>>> This is my first trial of syslog-ng. I've tried to start syslog-ng >>>>>>>>> just like described on the official bolg page >>>>>>>>> https://syslog-ng.com/blog/central-log-server-docker/ >>>>>>>>> https://syslog-ng.com/blog/collecting-docker-infrastructure-logs-using-sysl… >>>>>>>>> >>>>>>>>> I am starting docker container as: >>>>>>>>> >>>>>>>>> docker run -it -v >>>>>>>>> "$PWD"/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf --name syslog-ng -p >>>>>>>>> 514:514 -p 601:601 balabit/syslog-ng:latest >>>>>>>>> >>>>>>>>> But unfortunately it is failing to mount my custom (local) >>>>>>>>> configuration file from source to host, complaining about mounting a >>>>>>>>> directory onto file >>>>>>>>> >>>>>>>>> Error: >>>>>>>>> >>>>>>>>> docker: Error response from daemon: OCI runtime create failed: >>>>>>>>> container_linux.go:348: starting container process caused >>>>>>>>> "process_linux.go:402: container init caused \"rootfs_linux.go:58: mounting >>>>>>>>> \\"/home/smb/code/conf/syslog-ng.conf\\" to rootfs >>>>>>>>> \\"/var/lib/docker/devicemapper/mnt/52d32f854a030b396b03e7596ab5d71eb1a18f34a09d5e4997c437568749b259/rootfs\\" >>>>>>>>> at >>>>>>>>> \\"/var/lib/docker/devicemapper/mnt/52d32f854a030b396b03e7596ab5d71eb1a18f34a09d5e4997c437568749b259/rootfs/etc/syslog-ng/syslog-ng.conf\\" >>>>>>>>> caused \\"not a directory\\"\"": unknown: Are you trying to mount a >>>>>>>>> directory onto a file (or vice-versa)? Check if the specified host path >>>>>>>>> exists and is the expected type. >>>>>>>>> >>>>>>>>> Am I missing something? >>>>>>>>> >>>>>>>>> Please let me know >>>>>>>>> >>>>>>>>> Many Thanks >>>>>>>>> >>>>>>>>> Mujeeb >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> ______________________________________________________________________________ >>>>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>>>> Documentation: >>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> ______________________________________________________________________________ >>>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>>> Documentation: >>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> >>>>>>> >>>>>>> ______________________________________________________________________________ >>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>> Documentation: >>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>> >>>>>> ______________________________________________________________________________ >>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>> Documentation: >>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>> >>>>>> >>>>>> >>>>> >>>>> >>>>> ______________________________________________________________________________ >>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>> Documentation: >>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>> >>>>> >>>>> >>>> >>>> >>>> ______________________________________________________________________________ >>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>> Documentation: >>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>> >>>> >>>> >>> >>> ______________________________________________________________________________ >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>> >>> >

1 0

Unbale to mount syslog-ng.conf to /etc/syslog-ng using docker image
by Mujeeb Baig 25 May '18

25 May '18

Hi This is my first trial of syslog-ng. I've tried to start syslog-ng just like described on the official bolg page https://syslog-ng.com/blog/ central-log-server-docker/ https://syslog-ng.com/blog/collecting-docker- infrastructure-logs-using-syslog-ng/ I am starting docker container as: docker run -it -v "$PWD"/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf --name syslog-ng -p 514:514 -p 601:601 balabit/syslog-ng:latest But unfortunately it is failing to mount my custom (local) configuration file from source to host, complaining about mounting a directory onto file Error: docker: Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused "process_linux.go:402: container init caused \"rootfs_linux.go:58: mounting \\"/home/smb/code/conf/syslog-ng.conf\\" to rootfs \\"/var/lib/docker/ devicemapper/mnt/52d32f854a030b396b03e7596ab5d7 1eb1a18f34a09d5e4997c437568749b259/rootfs\\" at \\"/var/lib/docker/ devicemapper/mnt/52d32f854a030b396b03e7596ab5d7 1eb1a18f34a09d5e4997c437568749b259/rootfs/etc/syslog-ng/syslog-ng.conf\\" caused \\"not a directory\\"\"": unknown: Are you trying to mount a directory onto a file (or vice-versa)? Check if the specified host path exists and is the expected type. Am I missing something? Please let me know Many Thanks Mujeeb

4 7