[syslog-ng] No remote logging with hostname which has address is IPv6

[Alexandre Santos]

Hi Laci,
Here it goes:
root at localhost:~# /usr/sbin/syslog-ng -Fvde $SYSLOGNG_OPTS
--cfgfile=/etc/syslog-ng/mgmt-syslog-ng.conf
--pidfile=/var/lib/syslog-ng/mgmt-syslog-ng.pid
--persist-file=/var/lib/syslog-ng/mgmt-syslog-ng.persist
--control=/var/lib/syslog-ng/mgmt-syslog-ng.ctl --version
syslog-ng 3 (3.19.1)
Config version: 3.19
Installer-Version: 3.19.1
Revision: 3.19.1-5
Compile-Date: May 19 2019 11:03:30
Module-Directory: /usr/lib/syslog-ng/3.19
Module-Path: /usr/lib/syslog-ng/3.19
Include-Path: /usr/share/syslog-ng/include
Available-Modules:
affile,hook-commands,basicfuncs,afuser,csvparser,date,pseudofile,confgen,json-plugin,linux-kmsg-format,cef,system-source,syslogformat,afsql,appmodel,http,kvformat,afprog,afsocket,afmongodb,sdjournal,cryptofuncs,disk-buffer,dbparser
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: on
Enable-TCP-Wrapper: on
Enable-Linux-Caps: on
Enable-Systemd: on

Thanks, Alex

On Fri, Aug 28, 2020 at 11:58 AM Laszlo Szemere (lszemere) <
Laszlo.Szemere at oneidentity.com> wrote:

> Hello Alex,
>  Syslog-ng can be compiled with or without IPv6 support. As a first step
> please verify if it was compiled that way.
>
>  If you start Syslog-ng with the "--version" option it will print a little
> debug information about itself. Among other options there will be a line:
> "Enable-IPv6"
>
>  (If it was compiled with "Enable-IPv6: on", please copy the entire output
> here. It will help with the later investigation.)
>
> Best regards,
> Laci
> ------------------------------
> *From:* syslog-ng <syslog-ng-bounces at lists.balabit.hu> on behalf of
> Alexandre Santos <alexandre.rosas.santos at gmail.com>
> *Sent:* Friday, August 28, 2020 12:35
> *To:* Syslog-ng users' and developers' mailing list <
> syslog-ng at lists.balabit.hu>
> *Subject:* [syslog-ng] No remote logging with hostname which has address
> is IPv6
>
> CAUTION: This email originated from outside of the organization. Do not
> follow guidance, click links, or open attachments unless you recognize the
> sender and know the content is safe.
>
> Hi,
>
> I have configuration, which is sending log messages to a remote hostname
> (dns6server). The particularity of this remote server is that it is
> resolved to an IPv6 address.
>
> ping works fine:
> root at localhost:~# ping dns6server -c 3
> PING dns6server(2620:38:4::8:4000:238) 56 data bytes
> 64 bytes from 2620:38:4::8:4000:238: icmp_seq=1 ttl=63 time=0.354 ms
> 64 bytes from 2620:38:4::8:4000:238: icmp_seq=2 ttl=63 time=0.264 ms
> 64 bytes from 2620:38:4::8:4000:238: icmp_seq=3 ttl=63 time=0.310 ms
>
> But syslog-ng seems not to be able to resolve the ipv6 address:
>
> Aug 27 20:58:37 localhost systemd[1]: mgmt-syslog-ng.service: Succeeded.
>
> Aug 27 20:58:37 localhost systemd[1]: Stopped External Logger Daemon.
>
> Aug 27 20:58:37 localhost systemd[1]: Starting External Logger Daemon...
>
> Aug 27 20:58:37 localhost ip[32709]: [2020-08-27T20:58:37.841389] WARNING:
> With use-dns(no), dns-cache() will be forced to 'no' too!;
>
> Aug 27 20:58:46 localhost ip[32709]: [2020-08-27T20:58:46.854714] Error
> resolving hostname; host='dns6server'
>
> Aug 27 20:58:46 localhost ip[32709]: [2020-08-27T20:58:46.854758]
> Initiating connection failed, reconnecting; time_reopen='60'
>
> Aug 27 20:58:46 localhost systemd[1]: Started External Logger Daemon.
>
>
> Any Ideas?
>
>
> I am sending the configuration and debug log in attachment.
>
>
> Thanks in Advance,
>
> Alex
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20200828/4c3d97c9/attachment-0001.html>