Hello,

> 1. Will syslog-ng run just fine receiving udp and sending udp with those errors and without that module? If, so, I don’t care if I don’t get that module.

The modules most of the time are independent, and the network (udp, tcp) are independent of the afql module, so as long as you do not want to use SQL in configuration it shall be fine.

> 2. Is it possible to run syslog-ng and disable that module in the run command?

In the 3.2 version it loads a few modules by default based on the build configuration, this can be turned off with "@autoload-compiled-modules 0", with using this also make sure that nor in your configuration nor in the included files (scl.conf, module.conf) you do not have "@module afsql".

In this case it should not try to load the module. (I did not try it myself, this is purely based on code and documentation)

> 3. Can I remove syslog-ng and re-install disable that module on install?

I do not think it is possible with install, but via config (see above).

> 4. I’d rather not recompile if I don’t have to, but I found instructions for how to do that. Any tips would be appreciated.

Would you like to re-compile the 3.2 version ?

For newer version you could check either the docker image file: https://github.com/balabit/syslog-ng/blob/master/dbld/images/centos7/Dockerfile (it has steps to create an environment to compile syslog-ng in centos6)

Alternatively you could check our Travis CI file for steps: https://github.com/balabit/syslog-ng/blob/master/.travis.yml (unfortunately this is for ubuntu)

extra:

> yum install --downloadonly syslog-ng-libdbi 

The SQL is depending on the libdbi, which is not part of the syslog-ng, so you should try to find the libdbi packet instead of the syslog-ng-libdbi

--

Kokan

On Wed, Nov 15, 2017 at 5:16 PM craig bowser <reswob10@gmail.com> wrote:

I installed syslog-ng on an offline CentOS 6.x machine by first downloading all required rpms using this command: 

yumdownloader --resolve syslog-ng

There were two files needed, that did not download and I downloaded them separately using:

yumdownloader eventlog-0.2.13-1.el6.x86_64.rpm

and:

yumdownloader libnet-1.1.6-7.el6.x86_64.rpm

 

These are the files I moved to the offline server:

17,684 eventlog-0.2.13-1.el6.i686.rpm

17,804 eventlog-0.2.13-1.el6.x86_64.rpm

122,940 gamin-0.1.10-9.el6.i686.rpm

1,738,964 glib2-2.28.8-9.el6.i686.rpm

4,570,040 glibc-2.12-1.209.el6_9.2.i686.rpm

117,400 libgcc-4.4.7-18.el6.i686.rpm

60,464 libnet-1.1.6-7.el6.i686.rpm

59,196 libnet-1.1.6-7.el6.x86_64.rpm

111,688 libselinux-2.0.94-7.el6.i686.rpm

309,920 libstdc++-4.4.7-18.el6.i686.rpm

161,168 nss-softokn-freebl-3.14.3-23.3.el6_8.i686.rpm

201,096 pcre-7.8-7.el6.i686.rpm

452,548 syslog-ng-3.2.5-4.el6.i686.rpm

451,092 syslog-ng-3.2.5-4.el6.x86_64.rpm

63,536 tcp_wrappers-libs-7.6-58.el6.i686.rpm

74,284 zlib-1.2.3-29.el6.i686.rpm

 

Once I moved all these files to the offline server into their own folder, I ran: 

rpm –ivh *.rpm

to install.

 

I then checked the config file, made a couple of tweaks, then started syslog-ng using:

service syslog-ng start

 

I got the following errors:

 

Plugin module not found in 'module-path'; module-path='/lib64/syslog-ng', module='afsql'

Plugin module not found in 'module-path'; module-path='/lib64/syslog-ng', module='afsql'

[ OK ]

 

Syslog-ng was now running, just with these two errors.

 

A quick google pointed to the problem, syslog-ng is looking for the sql plugin and the solution:

yum install syslog-ng-libdbi

 

But when I tried to run

yumdownloader syslog-ng-libdbi

I got

"Nothing to download"

And when I tried

yum install --downloadonly syslog-ng-libdbi

I got

"Nothing to do"

 

So here are my questions:

 

1.       Will syslog-ng run just fine receiving udp and sending udp with those errors and without that module?  If, so, I don’t care if I don’t get that module.

2.       Is it possible to run syslog-ng and disable that module in the run command?

3.       Can I remove syslog-ng and re-install disable that module on install?

4.       I’d rather not recompile if I don’t have to, but I found instructions for how to do that.  Any tips would be appreciated.

 

Thanks.

 

Craig L Bowser
____________________________

This email is measured by size.  Bits and bytes may have settled during transport.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq