0

centos 7(x64),syslog-ng v 3.5

Below is my syslog-ng.cfg

@version:3.5
@include "scl.conf"
options {
    flush_lines (0);
    time_reopen (10);
    log_fifo_size (1000);
    chain_hostnames (off);
    use_dns (no);
    use_fqdn (no);
    create_dirs (no);
    keep_hostname (yes);
};
source s_sys {
    system();
    internal();
     udp(ip(0.0.0.0) port(514));
     tcp(ip(0.0.0.0) port(514));
};

destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog" flush_lines(10)); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_kern { file("/var/log/kern"); };
destination d_mlal { usertty("*"); };

filter f_kernel     { facility(kern); };
filter f_default    { level(info..emerg) and
                        not (facility(mail)
                        or facility(authpriv) 
                        or facility(cron)); };
filter f_auth       { facility(authpriv); };
filter f_mail       { facility(mail); };
filter f_emergency  { level(emerg); };
filter f_news       { facility(uucp) or
                        (facility(news) 
                        and level(crit..emerg)); };
filter f_boot   { facility(local7); };
filter f_cron   { facility(cron); };

log { source(s_sys); filter(f_kernel); destination(d_kern); };
log { source(s_sys); filter(f_default); destination(d_mesg); };
log { source(s_sys); filter(f_auth); destination(d_auth); };
log { source(s_sys); filter(f_mail); destination(d_mail); };
log { source(s_sys); filter(f_emergency); destination(d_mlal); };
log { source(s_sys); filter(f_news); destination(d_spol); };
log { source(s_sys); filter(f_boot); destination(d_boot); };
log { source(s_sys); filter(f_cron); destination(d_cron); };
@include "/etc/syslog-ng/conf.d/*.conf"
# Custom lines added below
source s_external { 
        udp(ip(102.94.26.26) port(514));
        #unix-dgram("/dev/log");
};

destination d_ext {
file("/var/log/$HOST-$YEAR$MONTH$DAY.log" owner(root) group(root) perm(0644) create_dirs(yes));
};

log { source(s_external); destination(d_ext); };

#Error

#systemctl restart syslog-ng
# journalctl -xe
-- Unit syslog-ng.service has failed.
-- 
-- The result is failed.
Aug 19 16:44:49 localhost.localdomain systemd[1]: Unit syslog-ng.service entered failed state.
Aug 19 16:44:49 localhost.localdomain systemd[1]: syslog-ng.service failed.
Aug 19 16:44:49 localhost.localdomain systemd[1]: syslog-ng.service holdoff time over, scheduling restart.
Aug 19 16:44:49 localhost.localdomain systemd[1]: start request repeated too quickly for syslog-ng.service
Aug 19 16:44:49 localhost.localdomain systemd[1]: Failed to start System Logger Daemon.
-- Subject: Unit syslog-ng.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit syslog-ng.service has failed.

The client linuxserver(centos 6) which sends log to syslog-ngserver have rsyslogd running with below line added

 *.* @102.94.26.27:514     #ip of syslog-ng server and port
2

1 Answer 1

1

Try running syslog-ng --syntax-only to verify that there are no syntax errors in your config, and syslog-ng -Fevd to get more detailed error messages. (I wanted to add this as a comment, but couldn't.)

Also, try to do a stop and a start, instead of restart.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.