Syslog service fails to start

Question

I have installed syslog-ng 3.5 on RasperryPi Debian Jessie. When I try to start the service, it fails

-- Unit syslog.socket has begun starting up.
Feb 10 12:29:28 blackbox systemd[1]: Socket service syslog.service not loaded, r
Feb 10 12:29:28 blackbox systemd[1]: Failed to listen on Syslog Socket.
-- Subject: Unit syslog.socket has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit syslog.socket has failed.
--
-- The result is failed.
Feb 10 12:29:28 blackbox systemd[1]: Starting System Logger Daemon...
-- Subject: Unit syslog-ng.service has begun with start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit syslog-ng.service has begun starting up.
Feb 10 12:29:29 blackbox systemd[1]: Started System Logger Daemon.
-- Subject: Unit syslog-ng.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit syslog-ng.service has finished starting up.
--
-- The start-up result is done.

I checked netstat and port 514 is not used by another process. This is the configuration I used, that worked fine with an older version:

source s_net { udp(ip(0.0.0.0) port(514)); };
destination d_cisco { file(“/var/log/cisco/cisco.log”); };
log { source(s_net); destination(d_cisco); };

When I try to run it manually:

root@blackbox:~# /usr/sbin/syslog-ng -d

Running application hooks; hook='1'
Running application hooks; hook='3'
syslog-ng starting up; version='3.5.6'
Incoming log entry; line='<164>Feb 10 2016 15:03:59: %PIX-4-400037: IDS:6053 DNS all records request from 5.172.120.51 to 192.168.0.3 on interface outside\x0a'
Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d', error='No such file or directory (2)'
Incoming log entry; line='<164>Feb 10 2016 15:04:03: %PIX-4-400037: IDS:6053 DNS all records request from 5.172.120.51 to 192.168.0.3 on interface outside\x0a'
Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d', error='No such file or directory (2)'
Incoming log entry; line='<164>Feb 10 2016 15:04:07: %PIX-4-400037: IDS:6053 DNS all records request from 5.172.120.51 to 192.168.0.3 on interface outside\x0a'
Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d', error='No such file or directory (2)'
Incoming log entry; line='<164>Feb 10 2016 15:04:07: %PIX-4-400011: IDS:2001 ICMP unreachable from 198.48.92.104 to 192.168.0.3 on interface outside\x0a'
Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d', error='No such file or directory (2)'
Incoming log entry; line='<164>Feb 10 2016 15:04:07: %PIX-4-313005: No matching connection for ICMP error message: icmp src outside:198.48.92.104 dst inside:192.168.0.3 (type 3, code 3) on outside interface.  Original IP payload: udp src 192.168.0.3/53 dst 198.48.92.104/17106.\x0a'
Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d', error='No such file or directory (2)'
^Csyslog-ng shutting down; version='3.5.6'
Running application hooks; hook='4'

root@blackbox:~# cd /var/log/cisco/
root@blackbox:/var/log/cisco# ls -l
total 0
-rwxrw-rw- 1 root root 0 Feb 10 11:43 cisco.log
root@blackbox:/var/log/cisco#

Answer 1

The Syslog-ng daemon was not booting properly here. Albeit it was configured for being a remote syslog server, port 514/UDP was also not showing in netstat.

Debugging the problem with the command:

/usr/sbin/syslog-ng -d

We saw the error:

Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d'

As the \xe2\x80\x9c are control codes for UTF-8 character codes, we arrived to the conclusion there were extraneous characters in the syslog-ng.confconfiguration file. They are probably due to copy&pasting the configuration from a web page, together with a system being configured with UTF-8.

Editing with with LANG=C for having minimal character translations with the command:

LANG=C vi /etc/syslog-ng/syslog-ng.conf

The user reported the following line without UTF-8 translation:

file(▒~@~\/var/log/cisco/cisco.log▒~@~]); 

Editing it as it should be, and restarting it, fixed the problem:

file("/var/log/cisco/cisco.log");

From: UTF-8

UTF-8 is a character encoding capable of encoding all possible characters, or code points, in Unicode. The encoding is variable-length and uses 8-bit code units.

Why “LANG=C”

In the C programming language, the locale name C “specifies the minimal environment for C translation”

Recommendation: be very careful when copying & pasting configurations directly from web pages. Not all Unix utils understand character sets other than the traditional ASCII representation.