[syslog-ng] Local sources seem not to be working

[Alexandre Santos]

Hi Szilard,

There is no filter:

source syslog_ng_src {
    internal();
};

destination d_localfile_syslog_ng {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/syslog-ng-internal.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
log {
    source(syslog_ng_src);
    destination(d_localfile_syslog_ng);
    flags(flow-control);
};

Thanks and Regards,
Alex

From: syslog-ng <syslog-ng-bounces at lists.balabit.hu> On Behalf Of Szilard Parrag (sparrag)
Sent: 19 de maio de 2022 08:59
To: syslog-ng at lists.balabit.hu
Subject: Re: [syslog-ng] Local sources seem not to be working

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.

Hi Alex,

We've checked it too and syslog-ng does not release the file descriptor of journald even with flow-control enabled.

Also, your internal logs seem rather terse, maybe there is a filter which filters out the important parts. Could you please check it?

Szilard
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20220519/48aaa0c2/attachment.htm>