Hi, If you use a recent enough syslog-ng (3.6+ or 3.7+) then the system() source automatically detects if your system has /dev/log or journal and collects logs accordingly. Peter Peter Czanik (CzP) <peter.czanik@oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik ________________________________ From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Sergey <a_s_y@sama.ru> Sent: Wednesday, October 9, 2019 11:43 To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Subject: Re: [syslog-ng] unix-stream: ignore non-existent pipe CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. On Wednesday 09 October 2019, Laszlo Szemere (lszemere) wrote:

could you please specify if you want to use the unix-stream source driver or the destination driver?

Sorry for the inaccuracy. The source driver in my case.

And I am not sure about, what do you mean by "ignore".

I would like to make a generic config for systems with and without systemd. "unix-dgram ("/run/systemd/journal/dev-log");" should be added to "source sys" but this absent without systemd and cause error. -- Regards, Sergey ______________________________________________________________________________ Member info: https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7CPeter.Czanik%40oneidentity.com%7C33dbd4881c174fbcd9da08d74ce89179%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637062434100995437&sdata=Yufzg2RvGblXP1FP3V9l%2BdMuHu8InJpfJpe9xdKR0Og%3D&reserved=0 Documentation: https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7CPeter.Czanik%40oneidentity.com%7C33dbd4881c174fbcd9da08d74ce89179%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637062434100995437&sdata=Jd2DxjHjm1XEHYcoFyu8QWNa7c%2BJzPMihxw8Fxgb0ew%3D&reserved=0 FAQ: https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7CPeter.Czanik%40oneidentity.com%7C33dbd4881c174fbcd9da08d74ce89179%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637062434100995437&sdata=cJJYUj62gquZVvHWeR5zU8YMY%2FWmQkaSX6G%2BLfgmA4Q%3D&reserved=0

Hello, There is a *system* source, that aim is to detect on the running system the proper source listening to. (in case of systemd the system source tries to fetch logs from journald) Does that cover your use case ? In case it is not, could you please the cases it cover, and the cases it does not ? Additionally you could always replace the *system* source with writting a system source block of your own described in *{install_prefix}/share/syslog-ng/include/scl/system/plugin.conf* -- Kokan On Wed, Oct 09, 2019 at 10:43:14PM +0400, Sergey wrote:

CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.

On Wednesday 09 October 2019, Laszlo Szemere (lszemere) wrote:

...

could you please specify if you want to use the unix-stream source driver or the destination driver?

Sorry for the inaccuracy. The source driver in my case.

...

And I am not sure about, what do you mean by "ignore".

I would like to make a generic config for systems with and without systemd. "unix-dgram ("/run/systemd/journal/dev-log");" should be added to "source sys" but this absent without systemd and cause error.

-- Regards, Sergey ______________________________________________________________________________ Member info: https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7CPeter.Kokai%40oneidentity.com%7C33dbd4881c174fbcd9da08d74ce89179%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637062434099775985&sdata=No448miaDulZFuA3AvHYj9N3F17xLk6VBmPKVFJDbcw%3D&reserved=0 Documentation: https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7CPeter.Kokai%40oneidentity.com%7C33dbd4881c174fbcd9da08d74ce89179%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637062434099775985&sdata=yzXFRXSEmfHuvrCg%2BdJUmmJ6FCMRPiomk%2BBi53%2BXuUs%3D&reserved=0 FAQ: https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7CPeter.Kokai%40oneidentity.com%7C33dbd4881c174fbcd9da08d74ce89179%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637062434099775985&sdata=lUioTMd0YIYMV29wMgWHhDv4BkCI7U7jOmJWXSiNFAE%3D&reserved=0