Hello,
I have installed syslog-ng OSE from source on Amazon Linux 2023
distribution (as there is no EPEL available on that distribution nor are
there any precompiled binaries for it)
When i start up syslog-ng in the local terminal with syslog-ng -Fedv , it
runs fine forever.. But when i start it with systemd : systemctl start
syslog-ng, the command times out (but does start in the background) and
then it the service restarts every two minutes or so.
I am stumped. any thoughts? where have i gone wrong?
appreciate any assistance you can offer.
thanks,
Darren
More information:
------------
i compiled with the following and saw no errors:
> ./configure --disable-smtp --disable-http --disable-python --disable-json
> make
> make install
------------
I created the systemd service file as so:
> cat /etc/systemd/system/syslog-ng.service
[Unit]
Description=System Logger Daemon
Documentation=man:syslog-ng(8)
After=network.target
[Service]
Type=notify
PIDFile=/run/syslogd.pid
ExecStart=/usr/local/sbin/syslog-ng -F -p /run/syslogd.pid
ExecReload=/bin/kill -HUP $MAINPID
StandardOutput=null
Restart=on-failure
[Install]
WantedBy=multi-user.target
------------
My config is here:
------------
> cat /usr/local/etc/syslog-ng.conf
@include “scl.conf”
source s_local {
system();
internal();
};
destination d_local {
file(“/var/log/messages”);
file(“/var/log/messages-kv.log” template(“$ISODATE $HOST $(format-welf
--scope all-nv-pairs)\n”) frac-digits(3));
};
log {
source(s_local);
destination(d_local);
};
@include /etc/syslog-ng.d/*.conf
> cat /etc/syslog.d/syslognet.conf
options {
long_hostnames(off);
sync(0);
keep_hostname(yes);
owner(“splunk”);
group(“splunk”);
perm(0640);
create_dirs(yes);
dir_perm(0750);
};
source s_tcp_net {
tcp(ip(0.0.0.0) port(41514));
};
source s_tls_net {
network (
ip(0.0.0.0) port(42514)
transport(“tls”)
tls(
key-file(“/path/to/syslog-ng.key”)
cert-file(“/path/to/syslog-ng.crt”)
peer-verify(no)
)
);
};
destination d_net {
file(“/data/syslog/app/${SOURCEIP}/${YEAR}${MONTH}${DAY}-app-data.log”);
};
log {
source(s_tcp_net);
source(s_tls_net);
destination(d_net);
};
------------
Here is what i see when i start it with systemd:
> systemctl start syslog-ng
Job for syslog-ng.service failed because a timeout was exceeded.
See “systemctl status syslog-ng.service” and “journalctl -xeu
syslog-ng.service” for details.
> systemctl status syslog-ng.service
syslog-ng.service - System Logger Daemon
Loaded: loaded (/etc/systemd/system/syslog-ng.service; enabled;
preset: enabled)
Active: activating (start) since Wed 2024-02-28 15:25:01 UTC; 35s ago
Docs: man:syslog-ng(8)
Main PID: 488557 (syslog-ng)
Tasks: 4 (limit: 2322)
Memory: 2.5M
CPU: 39ms
CGroup: /system.slice/syslog-ng.service
└─488557 /usr/local/sbin/syslog-ng -F -p /run/syslogd.pid
Feb 28 15:25:01 ip-172-31-7-110.ca-central-1.compute.internal systemd[1]:
Starting syslog-ng.service - System Logger Daemon...
------------
And here is what's in /var/log/messages showing the restart:
> cat /var/log/messages | grep syslog-ng
Feb 28 14:38:24 ip-172-31-7-110 syslog-ng[447117]: syslog-ng shutting down;
version=‘4.6.0’
Feb 28 14:38:25 ip-172-31-7-110 syslog-ng[447177]: syslog-ng starting up;
version=‘4.6.0’
Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection
accepted; fd=‘26’, client=‘AF_INET(1.2.3.4:27717)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection
accepted; fd=‘27’, client=‘AF_INET(1.2.3.4:2300)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection
accepted; fd=‘28’, client=‘AF_INET(1.2.3.4:31585)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection
accepted; fd=‘29’, client=‘AF_INET(1.2.3.4:17761)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:39:55 ip-172-31-7-110 syslog-ng[447177]: syslog-ng shutting down;
version=‘4.6.0’
Feb 28 14:39:55 ip-172-31-7-110 syslog-ng[447234]: syslog-ng starting up;
version=‘4.6.0’
Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection
accepted; fd=‘25’, client=‘AF_INET(1.2.3.4:7213)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection
accepted; fd=‘26’, client=‘AF_INET(1.2.3.4:9268)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection
accepted; fd=‘27’, client=‘AF_INET(1.2.3.4:13128)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection
accepted; fd=‘28’, client=‘AF_INET(1.2.3.4:3928)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:41:25 ip-172-31-7-110 syslog-ng[447234]: syslog-ng shutting down;
version=‘4.6.0’
Feb 28 14:41:26 ip-172-31-7-110 syslog-ng[447385]: syslog-ng starting up;
version=‘4.6.0’
Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection
accepted; fd=‘25’, client=‘AF_INET(1.2.3.4:1382)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection
accepted; fd=‘26’, client=‘AF_INET(1.2.3.4:5430)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection
accepted; fd=‘27’, client=‘AF_INET(1.2.3.4:6373)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection
accepted; fd=‘28’, client=‘AF_INET(1.2.3.4:26287)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:42:56 ip-172-31-7-110 syslog-ng[447385]: syslog-ng shutting down;
version=‘4.6.0’
Feb 28 14:42:56 ip-172-31-7-110 syslog-ng[447443]: syslog-ng starting up;
version=‘4.6.0’
Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection
accepted; fd=‘25’, client=‘AF_INET(1.2.3.4:15165)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection
accepted; fd=‘26’, client=‘AF_INET(1.2.3.4:6967)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection
accepted; fd=‘27’, client=‘AF_INET(1.2.3.4:27444)’,
local=‘AF_INET(0.0.0.0:41514)’
Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection
accepted; fd=‘28’, client=‘AF_INET(1.2.3.4:20758)’,
local=‘AF_INET(0.0.0.0:41514)’