[syslog-ng] graylog2 plugin not found

[Daniel Estermann]

Hi everybody,

I am running RHEL 8.5

    ➜  ~ head -2 /etc/os-release
    NAME="Red Hat Enterprise Linux"
    VERSION="8.5 (Ootpa)"
    ➜  ~ uname -a
    Linux zhm-lm00 4.18.0-348.12.2.el8_5.x86_64 #1 SMP Mon Jan 17 07:06:06 EST 2022 x86_64 x86_64 x86_64 GNU/Linux

The installation of syslog-ng was performed via DNF using EPEL repository:

    ➜  ~ dnf install -y syslog-ng
    >8.......8<
    Installing:
     syslog-ng     x86_64    3.23.1-2.el8   epel                              842 k
    Installing dependencies:
     ivykis        x86_64    0.42.4-2.el8   epel                               47 k
     libnet        x86_64    1.1.6-15.el8   rhel-8-for-x86_64-appstream-rpms   67 k
    >8.......8<

Now, I was trying to configure transport of syslog to graylog using the following documentation:

https://www.syslog-ng.com/community/b/blog/posts/graylog-destination-syslog-ng

However, I've received the following error message, when i tried to start syslog-ng with the new configuration:

    Error parsing destination statement, destination plugin graylog2 not found in /etc/syslog-ng/syslog-ng.conf:9:5-9:13:
    4       };
    5
    6       filter f_gitlab_runner {"${.SDATA.journald._SYSTEMD_UNIT}" eq "gitlab-runner.service"};
    7
    8       destination d_graylog {
    9----->     graylog2(
    9----->     ^^^^^^^^
    10              host("[MASKED]")
    11              port(12201)
    12              transport(tcp)
    13          );
    14      };
    syslog-ng documentation: https://www.balabit.com/support/documentation?product=syslog-ng-ose
    contact: https://lists.balabit.hu/mailman/listinfo/syslog-ng

Do I have to install that plugin separately? How to do that?

Kind Regards
Daniel Estermann
[http://www.ti8m.com/dam/jcr:59611d49-12ae-460f-b117-37384c0a05c7] <https://www.ti8m.com/insights/downloads/special-security>