[syslog-ng] Internal error, duplicate configuration elements...

Gergely Nagy algernon at balabit.hu
Thu Jun 5 14:58:25 CEST 2014

David Hauck <davidh at netacquire.com> writes:

> 20140604 09:54:47.780 err syslog(syslog-ng):Internal error, duplicate
> configuration elements refer to the same persistent config;
> name='afsocket_dd_connection(dgram,'
> The UDP configuration references from 'syslog-ng.conf' are as follows:
> destination d_NAaudit_Prio { file("/var/log/netacquire/audit_log" template(t_NAFormat_Prio)); udp("" port(514) template(t_NAFormat_Prio)); };
> destination d_NAmessage_Prio { udp("" port(514) template(t_NAFormat_Prio)); };
> Does anyone know what this message is referring too?

It refers to having an udp("" port(514)
template(t_NAFormat_Prio)) destination in the config twice: once in
d_NAaudit_Prio and once more in d_NAmessage_Prio. This is an error in
the config, something which can easily confuse syslog-ng. In general,
you should use a certain target in only one destination, and if you want
to send to the same destination from multiple sources, or via different
filters, use log{} blocks to tie them together.

I'd recommend structuring your config differently for the above reasons:
instead of describing *what* goes to a particular destination, name them
after *where* they go to, and bind the source->filter->destination chain
together in a log{} block.

For example:

destination d_205 { udp(...); };
destination d_na_audit { file("/var/log/netacquire/audit_log"
                              template(t_NAFormat_Prio)); };

log {

This will send every message from s_all source to the remote server,
then filter some, and put them in a file.

Hope that helps!


More information about the syslog-ng mailing list