Hello, I would say you are missing the LD_LIBRARY_PATH from your syslog-ng.service file. So it cannot find the java. You can either change your service file, or alternatively you can set /etc/ld.so.conf -- KP On Tue, 12 Sep 2017, 4:17 am Andrew <toranagtrx@gmail.com> wrote:

See below system information:

[root@logs ~]# java -version openjdk version "1.8.0_141" OpenJDK Runtime Environment (build 1.8.0_141-b16) OpenJDK 64-Bit Server VM (build 25.141-b16, mixed mode)

LD_LIBRARY_PATH=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.141-1.b16.el7_3.x86_64/jre/lib/amd64/server:

Operating System: CentOS Linux 7 (Core) CPE OS Name: cpe:/o:centos:centos:7 Kernel: Linux 3.10.0-514.26.2.el7.x86_64 Architecture: x86-64

Playing with this again today and it runs fine from the commandline eg. syslog-ng -Fevd

systemctl start syslog-ng results in the below, I find it strange that it complains about Java not being found only when running via systemd.

-- Unit syslog-ng.service has begun starting up. Sep 12 12:15:04 logs.domain.com syslog-ng[29141]: Error parsing destination, destination plugin java not found in destination block elasticsearch2 at line 2, column 3: Sep 12 12:15:04 logs.domain.com syslog-ng[29141]: included from /etc/syslog-ng/conf.d/utm.conf line 76, column 3 Sep 12 12:15:04 logs.domain.com syslog-ng[29141]: included from /etc/syslog-ng/syslog-ng.conf line 71, column 1 Sep 12 12:15:04 logs.domain.com syslog-ng[29141]: java Sep 12 12:15:04 logs.domain.com syslog-ng[29141]: ^^^^ Sep 12 12:15:04 logs.domain.com syslog-ng[29141]: syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng Sep 12 12:15:04 logs.domain.com syslog-ng[29141]: mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng Sep 12 12:15:04 logs.domain.com systemd[1]: syslog-ng.service: main process exited, code=exited, status=1/FAILURE Sep 12 12:15:04 logs.domain.com systemd[1]: Unit syslog-ng.service entered failed state. Sep 12 12:15:04 logs.domain.com systemd[1]: syslog-ng.service failed. Sep 12 12:15:05 logs.domain.com systemd[1]: syslog-ng.service holdoff time over, scheduling restart. Sep 12 12:15:05 logs.domain.com systemd[1]: start request repeated too quickly for syslog-ng.service Sep 12 12:15:05 logs.domain.com systemd[1]: Failed to start System Logger Daemon. -- Subject: Unit syslog-ng.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit syslog-ng.service has failed. -- -- The result is failed. Sep 12 12:15:05 logs.domain.com systemd[1]: Unit syslog-ng.service entered failed state. Sep 12 12:15:05 logs.domain.com systemd[1]: syslog-ng.service failed.

On Mon, Sep 11, 2017 at 3:18 PM, Kókai Péter <peter.kokai@balabit.com> wrote:

...

Hi,

Could you please give more information about your system? Which version of * syslog-ng * java * centos are you using? If possible which version of java have you used before?

Your environment variables related to java? Your syslog-ng configuration?

-- KP

On Mon, 11 Sep 2017, 7:12 am Andrew <toranagtrx@gmail.com> wrote:

...

I recently updated my CentOS server so there were new versions of Java and syslog-ng and I have been having issues ever since.

If I run it from systemd then it fails to load, yet if I run it manually it works fine and pushes the logs into elasticsearch. When trying to run from systemd it complains about Java plugin not being found.

systemctl start syslog-ng

Error parsing destination, destination plugin java not found in destination block elasticsearch2 at line 2, column 3

If I run it manually by typing syslog-ng then it works just fine.

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Hi, And to make your setting update proof, I'd like to emphasize the following paragraph from my blog: " Hint: while the exact path changes with the update of Java, there are often some simplified links available. For example on Fedora Linux: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.51-4.b16.fc22.x86_64/jre/lib/amd64/server/ is also available as /usr/lib/jvm/java/jre/lib/amd64/server The first link changes with each Java update, the second one stays stable between updates. " This, or a similar link exists also on CentOS. Bye, Peter Czanik (CzP) <peter.czanik@balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik On Tue, Sep 12, 2017 at 9:22 AM, Fabien Wernli <wernli@in2p3.fr> wrote:

Hi,

I believe Péter's diagnostic is correct. Another Péter's blog summarizes the "problem" on this blog post:

https://www.balabit.com/blog/troubleshooting-java-support-syslog-ng/

I for one chose the method of adding a file into ld's config file directory:

$ cat /etc/ld.so.conf.d/java.conf /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.141-1.b16.el7_3. x86_64/jre/lib/amd64/server

Of course your path will most probably be different. Also don't forget to run `ldconfig` afterwards.

Cheers

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq