Probably the user doesnt have write permission to /dev so it cannot remove the stale log socket, which causes the bind to fail.

You can create the log socket somewhere else (/var somewhere) and point a symlink from dev.

Then you can give permissions to user to the directory where the log socket resides.

On Feb 13, 2016 9:50 PM, "Ryan Koss" <rkoss@128technology.com> wrote:

Hello,

I’m trying to run syslog-ng as a non-root user. I’ve tried the following command as suggested by the site at the following URL https://www.balabit.com/wiki/syslog-ng-faq-non-root Unfortunately I am still encountering permissions issues.

?-> /usr/sbin/syslog-ng --user user --persist-file /code/routeiqSyslog/i95/build/src/lib/util/test/syslog-ng.persist
syslog-ng: Error setting capabilities, capability management disabled; error='Operation not permitted'
Error binding socket; addr='AF_UNIX(/dev/log)', error='Address already in use (98)'
Error initializing message pipeline;
?->

Any ideas, thoughts help will be greatly appreciated.

Thanks,
-ryan

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq