[syslog-ng] Problem activating: Centos7 + Syslog-ng OSE + Elasticsearch + kibana

Fri Apr 6 13:52:44 UTC 2018

Which version of syslog-ng are you using?

I guess the path for libjvm.so is set up correctly,
you can check: /usr/sbin/syslog-ng -V
Some help:
https://syslog-ng.com/blog/troubleshooting-java-support-syslog-ng/

Can you check the /etc/syslog-ng/scl.conf file please?
Does it have this line?
@define java-module-dir "`module-install-dir`/java-modules"

Gabor

On Fri, Apr 6, 2018 at 3:49 PM, Kókai Péter <peter.kokai at balabit.com> wrote:

> Hello,
>
> From the debug logs it looks to me that you have not installed
> *syslog-ng-java*. Otherwise it should be listed such as:
>
> "Registering candidate plugin; module='java', context='destination',
> name=java', preference='0'"
>
> Do you have the above mentioned package installed ?
>
> --
> Kokan
>
> On Fri, Apr 6, 2018 at 3:16 PM André F. Grehs <andre.grehs at bitcom.psi.br>
> wrote:
>
>>
>> Hi Gabor, thank you for your support.
>>
>> Below is the output:
>>
>> [root at syslog conf.d]# /usr/sbin/syslog-ng -Fedv
>> Starting to read include file; filename='/etc/syslog-ng/scl.conf',
>> depth='1'
>> Global value changed; define='scl-root', value='/usr/share/syslog-ng/
>> include/scl'
>> Global value changed; define='include-path', value='/etc/syslog-ng:/usr/
>> share/syslog-ng/include'
>> Starting to read include file; filename='/usr/share/syslog-
>> ng/include/scl/system/plugin.conf', depth='2'
>> Module loaded and initialized successfully; module='system-source'
>> Finishing include; filename='/usr/share/syslog-
>> ng/include/scl/system/plugin.conf', depth='2'
>> Starting to read include file; filename='/usr/share/syslog-
>> ng/include/scl/pacct/plugin.conf', depth='2'
>> Reading path for candidate modules; path='//usr/lib64/syslog-ng'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='affile.so', module='affile'
>> Registering candidate plugin; module='affile', context='source',
>> name='file', preference='0'
>> Registering candidate plugin; module='affile', context='source',
>> name='pipe', preference='0'
>> Registering candidate plugin; module='affile', context='destination',
>> name='file', preference='0'
>> Registering candidate plugin; module='affile', context='destination',
>> name='pipe', preference='0'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='afprog.so', module='afprog'
>> Registering candidate plugin; module='afprog', context='source',
>> name='program', preference='0'
>> Registering candidate plugin; module='afprog', context='destination',
>> name='program', preference='0'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='afsocket-notls.so',
>> module='afsocket-notls'
>> Registering candidate plugin; module='afsocket-notls', context='source',
>> name='unix-stream', preference='0'
>> Registering candidate plugin; module='afsocket-notls',
>> context='destination', name='unix-stream', preference='0'
>> Registering candidate plugin; module='afsocket-notls', context='source',
>> name='unix-dgram', preference='0'
>> Registering candidate plugin; module='afsocket-notls',
>> context='destination', name='unix-dgram', preference='0'
>> Registering candidate plugin; module='afsocket-notls', context='source',
>> name='tcp', preference='0'
>> Registering candidate plugin; module='afsocket-notls',
>> context='destination', name='tcp', preference='0'
>> Registering candidate plugin; module='afsocket-notls', context='source',
>> name='tcp6', preference='0'
>> Registering candidate plugin; module='afsocket-notls',
>> context='destination', name='tcp6', preference='0'
>> Registering candidate plugin; module='afsocket-notls', context='source',
>> name='udp', preference='0'
>> Registering candidate plugin; module='afsocket-notls',
>> context='destination', name='udp', preference='0'
>> Registering candidate plugin; module='afsocket-notls', context='source',
>> name='udp6', preference='0'
>> Registering candidate plugin; module='afsocket-notls',
>> context='destination', name='udp6', preference='0'
>> Registering candidate plugin; module='afsocket-notls', context='source',
>> name='syslog', preference='0'
>> Registering candidate plugin; module='afsocket-notls',
>> context='destination', name='syslog', preference='0'
>> Registering candidate plugin; module='afsocket-notls', context='source',
>> name='network', preference='0'
>> Registering candidate plugin; module='afsocket-notls',
>> context='destination', name='network', preference='0'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='afsocket-tls.so', module='afsocket-tls'
>> Registering candidate plugin; module='afsocket-tls', context='source',
>> name='unix-stream', preference='100'
>> Registering candidate plugin; module='afsocket-tls',
>> context='destination', name='unix-stream', preference='100'
>> Registering candidate plugin; module='afsocket-tls', context='source',
>> name='unix-dgram', preference='100'
>> Registering candidate plugin; module='afsocket-tls',
>> context='destination', name='unix-dgram', preference='100'
>> Registering candidate plugin; module='afsocket-tls', context='source',
>> name='tcp', preference='100'
>> Registering candidate plugin; module='afsocket-tls',
>> context='destination', name='tcp', preference='100'
>> Registering candidate plugin; module='afsocket-tls', context='source',
>> name='tcp6', preference='100'
>> Registering candidate plugin; module='afsocket-tls',
>> context='destination', name='tcp6', preference='100'
>> Registering candidate plugin; module='afsocket-tls', context='source',
>> name='udp', preference='100'
>> Registering candidate plugin; module='afsocket-tls',
>> context='destination', name='udp', preference='100'
>> Registering candidate plugin; module='afsocket-tls', context='source',
>> name='udp6', preference='100'
>> Registering candidate plugin; module='afsocket-tls',
>> context='destination', name='udp6', preference='100'
>> Registering candidate plugin; module='afsocket-tls', context='source',
>> name='syslog', preference='100'
>> Registering candidate plugin; module='afsocket-tls',
>> context='destination', name='syslog', preference='100'
>> Registering candidate plugin; module='afsocket-tls', context='source',
>> name='network', preference='100'
>> Registering candidate plugin; module='afsocket-tls',
>> context='destination', name='network', preference='100'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='afsocket.so', module='afsocket'
>> Registering candidate plugin; module='afsocket', context='source',
>> name='unix-stream', preference='100'
>> Registering candidate plugin; module='afsocket', context='destination',
>> name='unix-stream', preference='100'
>> Registering candidate plugin; module='afsocket', context='source',
>> name='unix-dgram', preference='100'
>> Registering candidate plugin; module='afsocket', context='destination',
>> name='unix-dgram', preference='100'
>> Registering candidate plugin; module='afsocket', context='source',
>> name='tcp', preference='100'
>> Registering candidate plugin; module='afsocket', context='destination',
>> name='tcp', preference='100'
>> Registering candidate plugin; module='afsocket', context='source',
>> name='tcp6', preference='100'
>> Registering candidate plugin; module='afsocket', context='destination',
>> name='tcp6', preference='100'
>> Registering candidate plugin; module='afsocket', context='source',
>> name='udp', preference='100'
>> Registering candidate plugin; module='afsocket', context='destination',
>> name='udp', preference='100'
>> Registering candidate plugin; module='afsocket', context='source',
>> name='udp6', preference='100'
>> Registering candidate plugin; module='afsocket', context='destination',
>> name='udp6', preference='100'
>> Registering candidate plugin; module='afsocket', context='source',
>> name='syslog', preference='100'
>> Registering candidate plugin; module='afsocket', context='destination',
>> name='syslog', preference='100'
>> Registering candidate plugin; module='afsocket', context='source',
>> name='network', preference='100'
>> Registering candidate plugin; module='afsocket', context='destination',
>> name='network', preference='100'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='afstomp.so', module='afstomp'
>> Registering candidate plugin; module='afstomp', context='destination',
>> name='stomp', preference='0'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='afuser.so', module='afuser'
>> Registering candidate plugin; module='afuser', context='destination',
>> name='usertty', preference='0'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='basicfuncs.so', module='basicfuncs'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='grep', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='if', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='echo', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='length', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='substr', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='strip', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='sanitize', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='lowercase', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='uppercase', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='replace-delimiter', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='+', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='-', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='*', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='/', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='%', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='ipv4-to-int', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='indent-multi-line', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='context-length', preference='0'
>> Registering candidate plugin; module='basicfuncs',
>> context='template-func', name='env', preference='0'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='confgen.so', module='confgen'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='cryptofuncs.so', module='cryptofuncs'
>> Registering candidate plugin; module='cryptofuncs',
>> context='template-func', name='uuid', preference='0'
>> Registering candidate plugin; module='cryptofuncs',
>> context='template-func', name='hash', preference='0'
>> Registering candidate plugin; module='cryptofuncs',
>> context='template-func', name='sha1', preference='0'
>> Registering candidate plugin; module='cryptofuncs',
>> context='template-func', name='sha256', preference='0'
>> Registering candidate plugin; module='cryptofuncs',
>> context='template-func', name='sha512', preference='0'
>> Registering candidate plugin; module='cryptofuncs',
>> context='template-func', name='md4', preference='0'
>> Registering candidate plugin; module='cryptofuncs',
>> context='template-func', name='md5', preference='0'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='csvparser.so', module='csvparser'
>> Registering candidate plugin; module='csvparser', context='parser',
>> name='csv-parser', preference='0'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='dbparser.so', module='dbparser'
>> Registering candidate plugin; module='dbparser', context='parser',
>> name='db-parser', preference='0'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='linux-kmsg-format.so',
>> module='linux-kmsg-format'
>> Registering candidate plugin; module='linux-kmsg-format',
>> context='format', name='linux-kmsg', preference='0'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='syslogformat.so', module='syslogformat'
>> Registering candidate plugin; module='syslogformat', context='format',
>> name='syslog', preference='0'
>> Registering candidate plugin; module='syslogformat', context='parser',
>> name='syslog-parser', preference='0'
>> Reading shared object for a candidate module;
>> path='//usr/lib64/syslog-ng', fname='system-source.so',
>> module='system-source'
>> Finishing include; filename='/usr/share/syslog-
>> ng/include/scl/pacct/plugin.conf', depth='2'
>> Starting to read include file; filename='/usr/share/syslog-
>> ng/include/scl/syslogconf/plugin.conf', depth='2'
>> Module loaded and initialized successfully; module='confgen'
>> Finishing include; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf',
>> depth='2'
>> Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1'
>> Module loaded and initialized successfully; module='afsocket-tls'
>> Module loaded and initialized successfully; module='affile'
>> Finishing include; content='source confgen system', depth='1'
>> Module loaded and initialized successfully; module='afuser'
>> Adding include file; filename='/etc/syslog-ng/conf.d/es.conf'
>> Starting to read include file; filename='/etc/syslog-ng/conf.d/es.conf',
>> depth='1'
>> Error parsing destination, destination plugin elasticsearch2 not found in
>> /etc/syslog-ng/conf.d/es.conf at line 5, column 3:
>>                                                             included from
>> /etc/syslog-ng/syslog-ng.conf line 68, column 1
>>
>>   elasticsearch2 (
>>   ^^^^^^^^^^^^^^
>>
>> syslog-ng documentation: http://www.balabit.com/support/documentation/?
>> product=syslog-ng
>> mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>
>>
>> ------------------------------
>> *De: *"Nagy, Gábor" <gabor.nagy at balabit.com>
>> *Para: *"Syslog-ng users' and developers' mailing list" <
>> syslog-ng at lists.balabit.hu>
>> *Enviadas: *Sexta-feira, 6 de abril de 2018 10:00:52
>> *Assunto: *Re: [syslog-ng] Problem activating: Centos7 + Syslog-ng OSE +
>> Elasticsearch + kibana
>>
>> Hi Andre!
>>
>> Can you start syslog-ng in forergound mode with debugging to find out
>> what is the problem?
>> "/usr/sbin/syslog-ng -Fedv"
>> Regards,
>> Gabor
>>
>> On Fri, Apr 6, 2018 at 1:29 PM, André Grehs <andre.grehs at bitcom.psi.br>
>> wrote:
>>
>>> Hi group!
>>>
>>>
>>>
>>> I installed a fresh Centos 7 setup to use it in a initial log management
>>> Project.
>>>
>>> I´m made the procedures described at thw wizard
>>> https://syslog-ng.com/blog/syslog-ng-and-elasticsearch-6-
>>> getting-started-on-rhelcentos/
>>>
>>> All is fine, but at the moment of the creation of the es.conf file of
>>> this procedure, the syslog-ng service could not start anymore. If i remove
>>> the es.conf file, the syslog-ng service start normally.
>>>
>>> Can you help me with this problem?
>>>
>>>
>>>
>>> P.S: Sorry for my english
>>>
>>>
>>>
>>> Best Regards!
>>>
>>>
>>>
>>> Andre.
>>>
>>> ____________________________________________________________
>>> __________________
>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>> Documentation: http://www.balabit.com/support/documentation/?
>>> product=syslog-ng
>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>
>>>
>>>
>>
>> ____________________________________________________________
>> __________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?
>> product=syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>> ____________________________________________________________
>> __________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?
>> product=syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180406/abe4f243/attachment-0001.html>