[syslog-ng] Incompatible Version Warnings

Dan Mahoney dmahoney at isc.org
Sat Mar 7 00:49:51 CET 2015

Hey there,

We have a number of systems that we're trying to deploy syslog-ng on, with 
puppet, which means we're dealing with multiple versions out there -- so 
we're trying to stay compatible with 3.4.

On a newer version (3.6), we get the following errors on startup:


[2015-03-06T20:47:33.065077] WARNING: Configuration file format is too 
old, syslog-ng is running in compatibility mode Please update it to use 
the syslog-ng 3.6 format at your time of convinience, compatibility mode 
can operate less efficiently in some cases. To upgrade the configuration, 
please review the warnings about incompatible changes printed by 
syslog-ng, and once completed change the @version header at the top of the 
configuration file.;
[2015-03-06T20:47:33.096433] WARNING: Starting with syslog-ng 3.6, the 
system() source performs JSON parsing of messages starting with the 
'@cim:' prefix. No additional action is needed;
[2015-03-06T20:47:33.096495] WARNING: Your configuration uses a newly 
introduced reserved word as identifier, please use a different name or 
enclose it in quotes before upgrading; keyword='channel', 
config-version='3.3', version='3.4', filename='source confgen system', 
Error parsing source, source plugin channel not found in source confgen 
system at line 1, column 1:
                                           included from 
/usr/local/etc/syslog-ng.conf line 27, column 9



I've found if I comment out the "system()" source it makes this error go 
away, but the requisiste lines are exactly what are referenced in the 

source s_local {

I suppose what's most confusing here, is syslog-ng is trying to tell me 
exactly where it finds the error, in the word "channel" saying "here, 
change this, this is the bad word I'm tripping over", but I don't find 
that word anywhere -- nor does it say *which* included file it's tripping 
over.  Maybe it's telling me that's the word it *needs* to find, but 
that's less clear.

I'm not finding anything in the mailing lists for this.

Finally, I should probably ask -- since syslog-ng has the ability to tag 
your config files with a given version, is there a way to say "use this 
config if you're on 3.4 and this version if you're on 3.6", so I can stay 
compatible with the various versions I've got deployed.

One other little nit: "Convenience"

-Dan Mahoney

More information about the syslog-ng mailing list