syslog-ng logging only as foreground process and not as daemon on centos7
I've got syslog-ng v3.7.3_7 running on FreeBSD 11-REL as the log server with both FreeBSD 11-REL and CentOS7 clients (the CentOS clients are running v3.5.6-3.el7 as it's the latest version installed by yum epel repo). It's always worked perfectly on the FreeBSD systems, but a few months ago I had the same problem described here when setting up a CentOS client- https://serverfault.com/questions/760383/syslog-ng-working-as-foreground-pro... ...I followed the fix of uncommenting the "ForwardToSyslog=yes" line in /etc/systemd/journald.conf and it started logging perfectly on CentOS clients, too. However, in setting up another CentOS7 client yesterday, this fix no longer worked. If I start syslog-ng via- chkconfig syslog-ng on systemctl restart syslog-ng.service ..it starts and runs and is shown in ps, starts automatically after reboot, but doesn't log to the server. If I start it manually from the terminal with- nohup /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid & ...then it does work and starts logging to the server immediately. In that case there are two identical (except for pid) lines shown by ps, e.g.- 482 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid 904 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid ...but only the one I started from the terminal (nohup...) actually logs. Any help would be much appreciated. -jl
I'd recommend running syslog-ng via: # syslog-ng -dF and see if the debug messages provide any clues. FWIW - i run syslog-ng-3.7.3-3.el7.centos.x86_64 in production and syslog-ng-3.9.1-1.el7.centos.x86_64 in development, without issue... From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jordan Ladora Sent: Wednesday, 8 February, 2017 10:11 To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] syslog-ng logging only as foreground process and not as daemon on centos7 I've got syslog-ng v3.7.3_7 running on FreeBSD 11-REL as the log server with both FreeBSD 11-REL and CentOS7 clients (the CentOS clients are running v3.5.6-3.el7 as it's the latest version installed by yum epel repo). It's always worked perfectly on the FreeBSD systems, but a few months ago I had the same problem described here when setting up a CentOS client- https://serverfault.com/questions/760383/syslog-ng-working-as-foreground-pro... ...I followed the fix of uncommenting the "ForwardToSyslog=yes" line in /etc/systemd/journald.conf and it started logging perfectly on CentOS clients, too. However, in setting up another CentOS7 client yesterday, this fix no longer worked. If I start syslog-ng via- chkconfig syslog-ng on systemctl restart syslog-ng.service ..it starts and runs and is shown in ps, starts automatically after reboot, but doesn't log to the server. If I start it manually from the terminal with- nohup /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid & ...then it does work and starts logging to the server immediately. In that case there are two identical (except for pid) lines shown by ps, e.g.- 482 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid 904 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid ...but only the one I started from the terminal (nohup...) actually logs. Any help would be much appreciated. -jl -------------------------------------------------------------------------------------------------------------------------- This email has been sent to you on behalf of Nephila Advisors LLC (“Advisors”). Advisors provides consultancy services to Nephila Capital Ltd. (“Capital”), an investment advisor managed and carrying on business in Bermuda. Advisors and its employees do not act as agents for Capital or the funds it advises and do not have the authority to bind Capital or such funds to any transaction or agreement. The information in this e-mail, and any attachment therein, is confidential and for use by the addressee only. Any use, disclosure, reproduction, modification or distribution of the contents of this e-mail, or any part thereof, other than by the intended recipient, is strictly prohibited. If you are not the intended recipient, please return the e-mail to the sender and delete it from your computer. This email is for information purposes only, nothing contained herein constitutes an offer to sell or buy securities, as such an offer may only be made from a properly authorized offering document. Although Nephila attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses. --------------------------------------------------------------------------------------------------------------------------
Hmm, there might be an issue with socket activation, which only happens when running under systemd. Can you do an lsof on the syslog-ng process? Does it open a socket somewhere in /run? If you invoke logger with explicit -u option where you specify the name of this socket, does it work? On Feb 8, 2017 5:11 PM, "Jordan Ladora" <vicepresjoebiden@gmail.com> wrote:
I've got syslog-ng v3.7.3_7 running on FreeBSD 11-REL as the log server with both FreeBSD 11-REL and CentOS7 clients (the CentOS clients are running v3.5.6-3.el7 as it's the latest version installed by yum epel repo).
It's always worked perfectly on the FreeBSD systems, but a few months ago I had the same problem described here when setting up a CentOS client-
https://serverfault.com/questions/760383/syslog-ng- working-as-foreground-process-but-not-as-daemon
...I followed the fix of uncommenting the "ForwardToSyslog=yes" line in /etc/systemd/journald.conf and it started logging perfectly on CentOS clients, too.
However, in setting up another CentOS7 client yesterday, this fix no longer worked. If I start syslog-ng via-
chkconfig syslog-ng on systemctl restart syslog-ng.service
..it starts and runs and is shown in ps, starts automatically after reboot, but doesn't log to the server. If I start it manually from the terminal with-
nohup /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid &
...then it does work and starts logging to the server immediately. In that case there are two identical (except for pid) lines shown by ps, e.g.-
482 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid 904 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid
...but only the one I started from the terminal (nohup...) actually logs.
Any help would be much appreciated.
-jl
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hello, Thanks for your help. lsof shows one entry in /run/...- syslog-ng 506 root 3u unix 0x00000000000000000 0t0 11105 /run/systemd/journal/syslog I'm sorry I'm confused about use of the '-u' option- am I to specify a user or a socket name? On Thu, Feb 9, 2017 at 10:40 PM, Scheidler, Balázs < balazs.scheidler@balabit.com> wrote:
Hmm, there might be an issue with socket activation, which only happens when running under systemd.
Can you do an lsof on the syslog-ng process? Does it open a socket somewhere in /run?
If you invoke logger with explicit -u option where you specify the name of this socket, does it work?
On Feb 8, 2017 5:11 PM, "Jordan Ladora" <vicepresjoebiden@gmail.com> wrote:
I've got syslog-ng v3.7.3_7 running on FreeBSD 11-REL as the log server with both FreeBSD 11-REL and CentOS7 clients (the CentOS clients are running v3.5.6-3.el7 as it's the latest version installed by yum epel repo).
It's always worked perfectly on the FreeBSD systems, but a few months ago I had the same problem described here when setting up a CentOS client-
https://serverfault.com/questions/760383/syslog-ng-working- as-foreground-process-but-not-as-daemon
...I followed the fix of uncommenting the "ForwardToSyslog=yes" line in /etc/systemd/journald.conf and it started logging perfectly on CentOS clients, too.
However, in setting up another CentOS7 client yesterday, this fix no longer worked. If I start syslog-ng via-
chkconfig syslog-ng on systemctl restart syslog-ng.service
..it starts and runs and is shown in ps, starts automatically after reboot, but doesn't log to the server. If I start it manually from the terminal with-
nohup /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid &
...then it does work and starts logging to the server immediately. In that case there are two identical (except for pid) lines shown by ps, e.g.-
482 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid 904 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid
...but only the one I started from the terminal (nohup...) actually logs.
Any help would be much appreciated.
-jl
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product= syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
participants (3)
-
Jordan Ladora
-
Robin Blanchard
-
Scheidler, Balázs