[syslog-ng] Internal error, duplicate configuration elements...

[Gergely Nagy]

David Hauck <davidh at netacquire.com> writes:

> 20140604 09:54:47.780 err syslog(syslog-ng):Internal error, duplicate
> configuration elements refer to the same persistent config;
> name='afsocket_dd_connection(dgram,205.159.216.207:514)'
>
> The UDP configuration references from 'syslog-ng.conf' are as follows:
>
> destination d_NAaudit_Prio { file("/var/log/netacquire/audit_log" template(t_NAFormat_Prio)); udp("205.159.216.207" port(514) template(t_NAFormat_Prio)); };
> destination d_NAmessage_Prio { udp("205.159.216.207" port(514) template(t_NAFormat_Prio)); };
>
> Does anyone know what this message is referring too?

It refers to having an udp("205.159.216.207" port(514)
template(t_NAFormat_Prio)) destination in the config twice: once in
d_NAaudit_Prio and once more in d_NAmessage_Prio. This is an error in
the config, something which can easily confuse syslog-ng. In general,
you should use a certain target in only one destination, and if you want
to send to the same destination from multiple sources, or via different
filters, use log{} blocks to tie them together.

I'd recommend structuring your config differently for the above reasons:
instead of describing *what* goes to a particular destination, name them
after *where* they go to, and bind the source->filter->destination chain
together in a log{} block.

For example:

destination d_205 { udp(...); };
destination d_na_audit { file("/var/log/netacquire/audit_log"
                              template(t_NAFormat_Prio)); };

log {
  source(s_all);
  destination(d_205);
  filter(f_na_audit);
  destination(d_na_audit);
};

This will send every message from s_all source to the remote server,
then filter some, and put them in a file.

Hope that helps!

-- 
|8]