[syslog-ng] "Error checking uniqueness"

[Scheidler, Balázs]

This bugs may not have surfaced in your simple examples though. The reason
we have a unique id requirement is that we store stuff like disk buffer
file name associated to destinations. Probably, you would not use the disk
buffer associated with a file destination, but internally you could.

An alternative solution is to define a single /var/log/audit.log
destination and then send messages from multiple log paths. For that to
work you'd have to construct the template associated with the destination
files a bit earlier in the processing chain.

hope this helps,
Bazsi



-- 
Bazsi

On Thu, Feb 23, 2017 at 5:50 PM, Noémi Ványi <sitbackandwait at gmail.com>
wrote:

> Syslog-ng stores persistent options and data in syslog-ng.persist file. It
> contains data about drivers specified in the configuration. The drivers are
> identified by their "settings". In your case you have three file drivers
> which contain the same log file: "/var/log/abc/audit_log". Thus, the id of
> that driver is not unique. To provide a unique identifier for these drivers
> you must specify a different string in persist-name.
>
> For example, you could add persist-name("abcaudit") to driver d_abcaudit,
> persist-name("abcaudit_Prio") to driver d_abcaudit_Prio and
> persist-name("abcaudit_IPtab") to d_abcaudit_IPtab. The key is that the
> string in persist-name is unique.
>
> Previously, handling multiple drivers on the same thing was broken in the
> usage of the persist file, if I recall correctly. This persist-name option
> was introduced to fix the problem. So, in previous versions it was buggy.
>
> BR,
> kvch
>
>
> On 23 February 2017 at 16:43, David Hauck <davidh at netacquire.com> wrote:
>
>> Hi András,
>>
>> On Thu, 23 Feb 2017 at 00:22:00, syslog-ng wrote:
>> > Hi David,
>> >
>> > The issue with persist_name() option was mentioned (and solved)
>> > previously in: https://github.com/balabit/syslog-
>> > ng/issues/1275
>>
>> Thx, I'd seen that entry prior to my email, however, it wasn't clear to
>> me what exactly this doing. And I wasn't able to find anything in the
>> documentation regarding the persist-name() option. Moreover, I wasn't sure
>> if this would work with my 'destination' specification (as seen below).
>>
>> What exactly does "persit-name()" do? How exactly do I specifcy this for
>> my destination specifications below? And what has changed between these two
>> versions to now require this option?
>>
>> Thanks,
>> -David
>>
>> > Br,
>> > Andras
>> >
>> >
>> > On Thu, Feb 23, 2017 at 1:28 AM, David Hauck <davidh at netacquire.com>
>> > wrote:
>> >
>> >
>> >       Hi,
>> >
>> >       I'm in the processing or updating a distribution's v3.6.3
>> syslog-ng
>> > configuration to v3.9.1 and am running into some issues getting
>> > syslog-ng started. The first one was:
>> >
>> >       Starting syslog-ng: Error parsing config, Error compiling template
>> > (Unknown template function "format-json") in
>> > /usr/share/syslog-ng/include/scl/cim/template.conf at line 23, column
>> > 32
>> >
>> >       I found a reference online to fixing this by removing
>> > /usr/share/syslog-ng/include/scl/cim and this indeed got me past this
>> > error (hopefully this is an otherwise benign modification).
>> >
>> >       I'm now stuck at the following error:
>> >
>> >       Starting syslog-ng: [2017-02-22T08:07:50.101422] Error checking
>> the
>> > uniqueness of the persist names, please override it with persist-name
>> > option. Shutting down.;
>> > persist_name='affile_dd_writers(/var/log/abc/audit_log)',
>> > location='/etc/syslog-ng.conf:128:33'
>> >
>> >       Here's snippet from my configuration file that this error message
>> > references:
>> >
>> >       ...
>> >       destination d_abcaudit         { file("/var/log/abc/audit_log"
>> > template(t_NAFormat));        };
>> >       destination d_abcaudit_Prio    { file("/var/log/abc/audit_log"
>> > template(t_NAFormat_Prio));   };
>> >       --> destination d_abcaudit_IPtab   {
>> > file("/var/log/abc/audit_log" template(t_abcFormat_IPtab));   };
>> >       destination d_abcmessage_Prio  { file("/dev/null"); };
>> >       ...
>> >
>> >       I wasn't able to find any documentation or guidance on the
>> > "persist-name" option. Any ideas on how I should go about fixing this
>> > error?
>> >
>> >       Thanks,
>> >       -David
>> >
>> > ______________________________________________________________________
>> > __ ______     Member info:
>> > https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> > <https://lists.balabit.hu/mailman/listinfo/syslog-ng>
>>  Documentation:
>> > http://www.balabit.com/support/documentation/?product=syslog-ng
>> > <http://www.balabit.com/support/documentation/?product=syslog-ng>
>>  FAQ:
>> > http://www.balabit.com/wiki/syslog-ng-faq
>> > <http://www.balabit.com/wiki/syslog-ng-faq>
>> >
>> >
>> >
>> ____________________________________________________________
>> __________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?product=
>> syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170223/18ae9c97/attachment-0001.html>