Hello,

Thanks for your help. 

lsof shows one entry in /run/...-
syslog-ng  506  root  3u  unix  0x00000000000000000  0t0  11105  /run/systemd/journal/syslog

I'm sorry I'm confused about use of the '-u' option- am I to specify a user or a socket name?




On Thu, Feb 9, 2017 at 10:40 PM, Scheidler, Balázs <balazs.scheidler@balabit.com> wrote:
Hmm, there might be an issue with socket activation, which only happens when running under systemd.

Can you do an lsof on the syslog-ng process? Does it open a socket somewhere in /run?

If you invoke logger with explicit -u option where you specify the name of this socket, does it work?

On Feb 8, 2017 5:11 PM, "Jordan Ladora" <vicepresjoebiden@gmail.com> wrote:
I've got syslog-ng v3.7.3_7 running on FreeBSD 11-REL as the log server with both FreeBSD 11-REL and CentOS7 clients (the CentOS clients are running v3.5.6-3.el7 as it's the latest version installed by yum epel repo). 

It's always worked perfectly on the FreeBSD systems, but a few months ago I had the same problem described here when setting up a CentOS client- 


...I followed the fix of uncommenting the "ForwardToSyslog=yes" line in /etc/systemd/journald.conf and it started logging perfectly on CentOS clients, too. 

However, in setting up another CentOS7 client yesterday, this fix no longer worked. If I start syslog-ng via-

chkconfig syslog-ng on
systemctl restart syslog-ng.service

..it starts and runs and is shown in ps, starts automatically after reboot, but doesn't log to the server. If I start it manually from the terminal with-

nohup /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid &

...then it does work and starts logging to the server immediately. In that case there are two identical (except for pid) lines shown by ps, e.g.-

482 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid
904 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid

...but only the one I started from the terminal (nohup...) actually logs. 

Any help would be much appreciated.

-jl


______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq



______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq