3.36.1 new log format of some internal messages
syslog-ng version 3.36.1 has introduced an additional time stamp in some of its internally generated log messages. [2022-04-05T07:10:27.574110] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.36 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.34' In the past this log message would have been formatted as WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.36 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.34' Is this intentional? Why is it not consistent with other internal messages such as syslog-ng starting up; version='3.36.1' Another thing of note is that the configuration warning is actually logged via journald while all other internal messages are only available in the syslog-ng log streams sourcing "internal()" -- Evan
What I find even more odd is that on a restart that warning is logged via journald and has the extra time stamp, but on a reload the warning is only logged internal to syslog-ng without the time stamp. This also started happening earlier that 3.36.1 The oldest version I have for testing is 3.34.1 which behaves the same way. On 2022-04-05 07:20, Evan Rempel wrote:
syslog-ng version 3.36.1 has introduced an additional time stamp in some of its internally generated log messages.
[2022-04-05T07:10:27.574110] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.36 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.34'
In the past this log message would have been formatted as
WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.36 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.34'
Is this intentional?
Why is it not consistent with other internal messages such as
syslog-ng starting up; version='3.36.1'
Another thing of note is that the configuration warning is actually logged via journald while all other internal messages are only available in the syslog-ng log streams sourcing "internal()"
-- Evan
Hi! I've double-checked, but we didn't change the internal logging format. I've also checked syslog-ng 3.31.2, 3.35.1 and 3.36.1 with the published syslog-ng docker images [1] (that are using the packages generated during a release), and I didn't see a difference. I think syslog-ng used stderr (where a timestamp has always been applied) and systemd captures stderr of services, hence the reason journald got the log message. Then syslog-ng read the same message from journald. The reason why some messages are sent to stderr is that in the early stages of syslog-ng startup, we don't have an internal source yet. I've reproduced the same behaviour you mentioned. This is from journald: Apr 06 13:29:27 minke syslog-ng[44729]: [2022-04-06T13:29:27.915350] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.36 format at your time of convenience. To upgrade the configur> Apr 06 13:29:27 minke syslog-ng[44729]: [2022-04-06T13:29:27.934844] WARNING: The internal_queue_length stat counter has been renamed to internal_source.queued. The old name will be removed in future versions; config-version='3.21' In short: some of the early internal messages (at config parsing time) will always be logged to stderr, and those will be captured by systemd. The behaviour though should be the same for both 3.31.2 and 3.36.1. - Gabor [1] https://hub.docker.com/r/balabit/syslog-ng
participants (2)
-
Evan Rempel
-
Gabor Nagy (gnagy)