[syslog-ng] file driver not usable in version 1.6.12 & version 2.0.8 not installable

[Balazs Scheidler]

On Thu, 2008-02-07 at 20:08 +0100, Uwe Galle wrote:
> Hi,
> 
> I am working with openSUSE 10.3 what comes with version 1.6.12
> preinstalled. I tried to use the file driver with this version but it
> didn't allow me to use it.
> 
> First I tried the following syslog-ng.conf file:
> 
> source s_file { file("/var/log/boot.msg"); };
> destination d_file { file("/home/uga/Daten/test/syslog.log"); };
> log {source (s_file); destination(d_file); };
> 
> When syslog-ng was started, it displayed the following error:
> 
> Re-Starting syslog servicesError opening file /var/log/boot.msg for
> reading (Permission denied)
> Error initializing configuration, exiting.
> startproc:  exit status of parent of /sbin/syslog-ng: 1
> 
> OK, I thought, this sounds like an OS problem. I investigated the file
> but didn't find any problem related to permissions. Then, I tried
> another file and added that after the first line:
> 
> source s_file { file("/var/log/boot.msg"); };
> source a_file { file("/var/log/apache2/access_log"); };
> destination d_file { file("/home/uga/Daten/test/syslog.log"); };
> log {source (s_file); destination(d_file); };
> 
> Now I got the error:
> 
> Re-Starting syslog servicesError opening
> file /var/log/apache2/access_log for reading (Permission denied)
> Error initializing configuration, exiting.
> startproc:  exit status of parent of /sbin/syslog-ng: 1
> 
> I saw that the error related to the first file has disappeared but
> reappeared with the second file. That let me suspect that this error is
> a bug that always causes an error with the last source file in the
> config file. To go sure I tried a third version:
> 
> source s_file { file("/var/log/boot.msg"); };
> source a_file { file("/var/log/apache2/access_log"); };
> source x_file { file("/home/uga/Daten/test/test.msg"); };
> destination d_file { file("/home/uga/Daten/test/syslog.log"); };
> log {source (s_file); destination(d_file); };
> 
> I fact, the error still appears, but not with the first two and already
> tested files but with the last third and new file.
> 
> Now I installed the last Open Source version 2.0.8. All steps finished
> without error but syslog-ng -V still shows "syslog-ng 1.6.12", even
> after reboot.
> 
> I didn't find any entry in the FAQ related to these two problems so I
> want to ask you to help me.

I know it is always difficult to use a newer upstream than what the
distro provides, but I don't recomment 1.6.x if you want to read files
as source. The 1.6.x version did not remember file positions accross
restarts for example.

So I'd recommend going towards the 2.0.8 route, the problem is probably
caused by the fact that syslog-ng installs /usr/local by default and
SUSE provides syslog-ng is /sbin/syslog-ng, the one first in the PATH
wins.

-- 
Bazsi