Syslog-ng stores persistent options and data in syslog-ng.persist file. It contains data about drivers specified in the configuration. The drivers are identified by their "settings". In your case you have three file drivers which contain the same log file: "/var/log/abc/audit_log". Thus, the id of that driver is not unique. To provide a unique identifier for these drivers you must specify a different string in persist-name. For example, you could add persist-name("abcaudit") to driver d_abcaudit, persist-name("abcaudit_Prio") to driver d_abcaudit_Prio and persist-name("abcaudit_IPtab") to d_abcaudit_IPtab. The key is that the string in persist-name is unique. Previously, handling multiple drivers on the same thing was broken in the usage of the persist file, if I recall correctly. This persist-name option was introduced to fix the problem. So, in previous versions it was buggy. BR, kvch On 23 February 2017 at 16:43, David Hauck <davidh@netacquire.com> wrote:

Hi András,

On Thu, 23 Feb 2017 at 00:22:00, syslog-ng wrote:

...

Hi David,

The issue with persist_name() option was mentioned (and solved) previously in: https://github.com/balabit/syslog- ng/issues/1275

Thx, I'd seen that entry prior to my email, however, it wasn't clear to me what exactly this doing. And I wasn't able to find anything in the documentation regarding the persist-name() option. Moreover, I wasn't sure if this would work with my 'destination' specification (as seen below).

What exactly does "persit-name()" do? How exactly do I specifcy this for my destination specifications below? And what has changed between these two versions to now require this option?

Thanks, -David

...

Br, Andras

On Thu, Feb 23, 2017 at 1:28 AM, David Hauck <davidh@netacquire.com> wrote:

Hi,

I'm in the processing or updating a distribution's v3.6.3 syslog-ng configuration to v3.9.1 and am running into some issues getting syslog-ng started. The first one was:

Starting syslog-ng: Error parsing config, Error compiling template (Unknown template function "format-json") in /usr/share/syslog-ng/include/scl/cim/template.conf at line 23, column 32

I found a reference online to fixing this by removing /usr/share/syslog-ng/include/scl/cim and this indeed got me past this error (hopefully this is an otherwise benign modification).

I'm now stuck at the following error:

Starting syslog-ng: [2017-02-22T08:07:50.101422] Error checking the uniqueness of the persist names, please override it with persist-name option. Shutting down.; persist_name='affile_dd_writers(/var/log/abc/audit_log)', location='/etc/syslog-ng.conf:128:33'

Here's snippet from my configuration file that this error message references:

... destination d_abcaudit { file("/var/log/abc/audit_log" template(t_NAFormat)); }; destination d_abcaudit_Prio { file("/var/log/abc/audit_log" template(t_NAFormat_Prio)); }; --> destination d_abcaudit_IPtab { file("/var/log/abc/audit_log" template(t_abcFormat_IPtab)); }; destination d_abcmessage_Prio { file("/dev/null"); }; ...

I wasn't able to find any documentation or guidance on the "persist-name" option. Any ideas on how I should go about fixing this error?

Thanks, -David

______________________________________________________________________ __ ______ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq>

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Can you show a simplified example of how to use a single destination but define different templates that write to it? I have never been able to figure that out and it should make some of my configs a lot easier. Evan. On 02/23/2017 08:56 AM, Scheidler, Balázs wrote:

This bugs may not have surfaced in your simple examples though. The reason we have a unique id requirement is that we store stuff like disk buffer file name associated to destinations. Probably, you would not use the disk buffer associated with a file destination, but internally you could.

An alternative solution is to define a single /var/log/audit.log destination and then send messages from multiple log paths. For that to work you'd have to construct the template associated with the destination files a bit earlier in the processing chain.

hope this helps, Bazsi

-- Bazsi

On Thu, Feb 23, 2017 at 5:50 PM, Noémi Ványi <sitbackandwait@gmail.com <mailto:sitbackandwait@gmail.com>> wrote:

Syslog-ng stores persistent options and data in syslog-ng.persist file. It contains data about drivers specified in the configuration. The drivers are identified by their "settings". In your case you have three file drivers which contain the same log file: "/var/log/abc/audit_log". Thus, the id of that driver is not unique. To provide a unique identifier for these drivers you must specify a different string in persist-name.

For example, you could add persist-name("abcaudit") to driver d_abcaudit, persist-name("abcaudit_Prio") to driver d_abcaudit_Prio and persist-name("abcaudit_IPtab") to d_abcaudit_IPtab. The key is that the string in persist-name is unique.

Previously, handling multiple drivers on the same thing was broken in the usage of the persist file, if I recall correctly. This persist-name option was introduced to fix the problem. So, in previous versions it was buggy.

BR, kvch

On 23 February 2017 at 16:43, David Hauck <davidh@netacquire.com <mailto:davidh@netacquire.com>> wrote:

Hi András,

On Thu, 23 Feb 2017 at 00:22:00, syslog-ng wrote: > Hi David, > > The issue with persist_name() option was mentioned (and solved) > previously in: https://github.com/balabit/syslog- <https://github.com/balabit/syslog-> > ng/issues/1275

Thx, I'd seen that entry prior to my email, however, it wasn't clear to me what exactly this doing. And I wasn't able to find anything in the documentation regarding the persist-name() option. Moreover, I wasn't sure if this would work with my 'destination' specification (as seen below).

What exactly does "persit-name()" do? How exactly do I specifcy this for my destination specifications below? And what has changed between these two versions to now require this option?

Thanks, -David

> Br, > Andras > > > On Thu, Feb 23, 2017 at 1:28 AM, David Hauck <davidh@netacquire.com <mailto:davidh@netacquire.com>> > wrote: > > > Hi, > > I'm in the processing or updating a distribution's v3.6.3 syslog-ng > configuration to v3.9.1 and am running into some issues getting > syslog-ng started. The first one was: > > Starting syslog-ng: Error parsing config, Error compiling template > (Unknown template function "format-json") in > /usr/share/syslog-ng/include/scl/cim/template.conf at line 23, column > 32 > > I found a reference online to fixing this by removing > /usr/share/syslog-ng/include/scl/cim and this indeed got me past this > error (hopefully this is an otherwise benign modification). > > I'm now stuck at the following error: > > Starting syslog-ng: [2017-02-22T08:07:50.101422] Error checking the > uniqueness of the persist names, please override it with persist-name > option. Shutting down.; > persist_name='affile_dd_writers(/var/log/abc/audit_log)', > location='/etc/syslog-ng.conf:128:33' > > Here's snippet from my configuration file that this error message > references: > > ... > destination d_abcaudit { file("/var/log/abc/audit_log" > template(t_NAFormat)); }; > destination d_abcaudit_Prio { file("/var/log/abc/audit_log" > template(t_NAFormat_Prio)); }; > --> destination d_abcaudit_IPtab { > file("/var/log/abc/audit_log" template(t_abcFormat_IPtab)); }; > destination d_abcmessage_Prio { file("/dev/null"); }; > ... > > I wasn't able to find any documentation or guidance on the > "persist-name" option. Any ideas on how I should go about fixing this > error? > > Thanks, > -David > > ______________________________________________________________________

Hi Noémi, Excellent information, thx! I'll give this a try... Thanks again, -David On Thursday, February 23, 2017 8:50 AM, syslog-ng wrote:

Syslog-ng stores persistent options and data in syslog-ng.persist file. It contains data about drivers specified in the configuration. The drivers are identified by their "settings". In your case you have three file drivers which contain the same log file: "/var/log/abc/audit_log". Thus, the id of that driver is not unique. To provide a unique identifier for these drivers you must specify a different string in persist-name.

For example, you could add persist-name("abcaudit") to driver d_abcaudit, persist- name("abcaudit_Prio") to driver d_abcaudit_Prio and persist-name("abcaudit_IPtab") to d_abcaudit_IPtab. The key is that the string in persist-name is unique.

Previously, handling multiple drivers on the same thing was broken in the usage of the persist file, if I recall correctly. This persist-name option was introduced to fix the problem. So, in previous versions it was buggy.

BR, kvch

On 23 February 2017 at 16:43, David Hauck <davidh@netacquire.com <mailto:davidh@netacquire.com> > wrote:

Hi András,

On Thu, 23 Feb 2017 at 00:22:00, syslog-ng wrote: > Hi David, > > The issue with persist_name() option was mentioned (and solved) > previously in: https://github.com/balabit/syslog- <https://github.com/balabit/syslog-> > ng/issues/1275

Thx, I'd seen that entry prior to my email, however, it wasn't clear to me what exactly this doing. And I wasn't able to find anything in the documentation regarding the persist-name() option. Moreover, I wasn't sure if this would work with my 'destination' specification (as seen below).

What exactly does "persit-name()" do? How exactly do I specifcy this for my destination specifications below? And what has changed between these two versions to now require this option?

Thanks, -David

...

Br, > Andras > > > On Thu, Feb 23, 2017 at 1:28 AM, David Hauck <davidh@netacquire.com <mailto:davidh@netacquire.com> > > wrote: > > Hi, > > I'm in the processing or updating a distribution's v3.6.3 syslog-ng > configuration to v3.9.1 and am running into some issues getting > syslog-ng started. The first one was: > > Starting syslog-ng: Error parsing config, Error compiling template > (Unknown template function "format-json") in > /usr/share/syslog-ng/include/scl/cim/template.conf at line 23, column > 32 > > I found a reference online to fixing this by removing > /usr/share/syslog-ng/include/scl/cim and this indeed got me past this > error (hopefully this is an otherwise benign modification). > > I'm now stuck at the following error: > > Starting syslog-ng: [2017-02-22T08:07:50.101422] Error checking the > uniqueness of the persist names, please override it with persist-name > option. Shutting down.; > persist_name='affile_dd_writers(/var/log/abc/audit_log)', > location='/etc/syslog-ng.conf:128:33' > > Here's snippet from my configuration file that this error message > references: > > ... > destination d_abcaudit { file("/var/log/abc/audit_log" > template(t_NAFormat)); }; > destination d_abcaudit_Prio { file("/var/log/abc/audit_log" > template(t_NAFormat_Prio)); }; > --> destination d_abcaudit_IPtab { > file("/var/log/abc/audit_log" template(t_abcFormat_IPtab)); }; > destination d_abcmessage_Prio { file("/dev/null"); }; > ... > > I wasn't able to find any documentation or guidance on the > "persist-name" option. Any ideas on how I should go about fixing this > error? > > Thanks, > -David

Hi, Do you have a libjson-plugin.so in syslog-ng --module-registry output? Also, can you check your configure output if libjson-c was detected? On Feb 23, 2017 20:27, "David Hauck" <davidh@netacquire.com> wrote:

Hi,

On Thursday, February 23, 2017 10:56 AM, David Hauck wrote:

...

Hi Noémi,

Excellent information, thx! I'll give this a try...

So this corrected the failures and I now have syslog-ng running again with my pre-existing configuration.

I'd like to come back to the "format-json" error (corrected by removing the /usr/share/syslog-ng/include/scl/cim folder). I went back and looked at my build configuration and see that I didn't have "--enable-json" present. Thinking this might have been at the root of this problem I rebuilt and redeployed. However, I still see this error. Is there a better way to fix this?

Regards, -David

...

Thanks again, -David

On Thursday, February 23, 2017 8:50 AM, syslog-ng wrote:

...

Syslog-ng stores persistent options and data in syslog-ng.persist file. It contains data about drivers specified in the configuration. The drivers are identified by their "settings". In your case you have three file drivers which contain the same log file: "/var/log/abc/audit_log". Thus, the id of that driver is not unique. To provide a unique identifier for these drivers you must specify a different string in persist-name.

For example, you could add persist-name("abcaudit") to driver d_abcaudit, persist- name("abcaudit_Prio") to driver d_abcaudit_Prio and persist-name("abcaudit_IPtab") to d_abcaudit_IPtab. The key is that the string in persist-name is unique.

Previously, handling multiple drivers on the same thing was broken in the usage of the persist file, if I recall correctly. This persist-name option was introduced to fix the problem. So, in previous versions it was buggy.

BR, kvch

On 23 February 2017 at 16:43, David Hauck <davidh@netacquire.com <mailto:davidh@netacquire.com> > wrote:

Hi András,

On Thu, 23 Feb 2017 at 00:22:00, syslog-ng wrote: > Hi David, > > The issue with persist_name() option was mentioned (and solved) > previously in: https://github.com/balabit/syslog- <https://github.com/balabit/syslog-> > ng/issues/1275

Thx, I'd seen that entry prior to my email, however, it wasn't clear to me what exactly this doing. And I wasn't able to find anything in the documentation regarding the persist-name() option. Moreover, I wasn't sure if this would work with my 'destination' specification (as seen below).

What exactly does "persit-name()" do? How exactly do I specifcy this for my destination specifications below? And what has changed between these two versions to now require this option?

Thanks, -David

> Br, > Andras > > > On Thu, Feb 23, 2017 at 1:28 AM, David Hauck <davidh@netacquire.com <mailto:davidh@netacquire.com> > > wrote: > > > Hi, > > I'm in the processing or updating a distribution's v3.6.3 syslog-ng > configuration to v3.9.1 and am running into some issues getting > syslog-ng started. The first one was: > > Starting syslog-ng: Error parsing config, Error compiling template > (Unknown template function "format-json") in > /usr/share/syslog-ng/include/scl/cim/template.conf at line 23, column > 32 > > I found a reference online to fixing this by removing > /usr/share/syslog-ng/include/scl/cim and this indeed got me past this > error (hopefully this is an otherwise benign modification). > > I'm now stuck at the following error: > > Starting syslog-ng: [2017-02-22T08:07:50.101422] Error checking the > uniqueness of the persist names, please override it with persist-name > option. Shutting down.; > persist_name='affile_dd_writers(/var/log/abc/audit_log)',

...

location='/etc/syslog-ng.conf:128:33' > > Here's snippet from my configuration file that this error message > references: > > ... > destination d_abcaudit { file("/var/log/abc/audit_log" > template(t_NAFormat)); }; > destination d_abcaudit_Prio { file("/var/log/abc/audit_log" > template(t_NAFormat_Prio)); }; > --> destination d_abcaudit_IPtab { > file("/var/log/abc/audit_log" template(t_abcFormat_IPtab)); }; > destination d_abcmessage_Prio { file("/dev/null"); }; > ... > > I wasn't able to find any documentation or guidance on the > "persist-name" option. Any ideas on how I should go about fixing this > error? > > Thanks, > -David

---

__________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Cool. Great to hear. On Feb 24, 2017 9:10 PM, "David Hauck" <davidh@netacquire.com> wrote:

Hi Balázs,

On Thursday, February 23, 2017 10:33 PM, syslog-ng wrote:

...

Hi,

Do you have a libjson-plugin.so in syslog-ng --module-registry output? Also, can you check your configure output if libjson-c was detected?

OK, I was able to get this working; my previous test hadn't fully ensured syslog-ng was built with --enable-json. Ensuring 'json-c' is available during the configure stage and re-building corrected this (no 'format-json' error at runtime and no need to remove the 'cim' directory).

Thanks, -David

...

On Feb 23, 2017 20:27, "David Hauck" <davidh@netacquire.com> wrote:

Hi,

On Thursday, February 23, 2017 10:56 AM, David Hauck wrote: > Hi Noémi, > > Excellent information, thx! I'll give this a try...

So this corrected the failures and I now have syslog-ng running again with my pre-existing configuration.

I'd like to come back to the "format-json" error (corrected by removing the /usr/share/syslog- ng/include/scl/cim folder). I went back and looked at my build configuration and see that I didn't have "- -enable-json" present. Thinking this might have been at the root of this problem I rebuilt and redeployed. However, I still see this error. Is there a better way to fix this?

Regards, -David

---

__________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq