[syslog-ng] syslog-ng won't talk to systemd?

[Balazs Scheidler]

system () automatically adds systemd-journald(), that's why your second
such source triggers the error about duplicate sources.

With that said, why syslog-ng doesn't get messages from systems is a a
different issue.



On Sun, Jan 24, 2021, 08:07 Dan Egli <dan at newideatest.site> wrote:

> I'm trying to setup syslog-ng on a systemd system. But even though I have
> several things writing to syslog, syslog-ng doesn't write ANYTHING to the
> /var/log/messages except kernel messages and it's own info. So I searched
> around, and found the systemd-journal() source. So I tried it. And I get an
> error that says syslog-ng can't initialize the logger plugin:
>
>
> # syslog-ng -F
> [2021-01-23T23:25:36.525097] The configuration must not contain more than one systemd-journal() source;
> [2021-01-23T23:25:36.525157] Error initializing journal_reader;
> [2021-01-23T23:25:36.525173] Error initializing message pipeline; plugin_name='systemd-journal', location='/etc/syslog-ng/syslog-ng.conf:26:5'
>
>
> Here's the config, basically copied from the syslog-ng.com page:
>
> @version: 3.26
> #
> # Syslog-ng default configuration file for Gentoo Linux
>
> # https://bugs.gentoo.org/426814
> @include "scl.conf"
>
> options {
> 	threaded(yes);
> 	chain_hostnames(no);
> 	stats_freq(43200);
> 	mark_freq(3600);
> };
>
> source s_journald {
>
>     systemd-journal(prefix(".SDATA.journald."));
>
> };
>
>
> source src { system(); internal(); file("/proc/kmsg"); };
>
> destination messages { file("/var/log/messages"); };
> destination console_all { file("/dev/tty12"); };
>
> log { source(src); destination(messages); };
> log { source(s_journald); destination(messages); };
> log { source(src); destination(console_all); };
>
>
> What am I doing wrong? I am POSITIVE things are sending to the syslog
> sub-system. I have ensured several programs have sent something. But
> without the systemd-journal line syslog-ng loads fine, recording /proc/kmsg
> and syslog-ng messages but nothing else.
>
> I am completely stumped here.
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20210124/70686067/attachment.html>