Re: [gentoo-user] syslog-ng-3.6.1 nearly no log anymore

[Alan McKinnon]

On 14/11/2014 20:44, Helmut Jarausch wrote:
> On 11/14/2014 06:46:28 PM, Alan McKinnon wrote:
>> On 14/11/2014 18:18, Helmut Jarausch wrote:
>>> On 11/13/2014 09:05:50 PM, Alan McKinnon wrote:
>>>> On 13/11/2014 18:41, Helmut Jarausch wrote:
>>>>> Hi,
>>>>>
>>>>> after upgrading from syslog-ng-3.5.6  to syslog-ng-3.6.1 my
>> system
>>>> has
>>>>> stopped logging, i.e. I only get the messages
>>>>> Nov 12 21:04:10 numa syslog-ng[1392]: syslog-ng shutting down;
>>>>> version='3.6.1'
>>>>> Nov 13 14:52:20 numa syslog-ng[1392]: syslog-ng starting up;
>>>>> version='3.6.1'
>>>>>
>>>>> Has anybody observed the same problem, and how to fix it?
>>>>>
>>>>> Many thanks for a hint,
>>>>> Helmut
>>>>>
>>>>>
>>>>
>>>>
>>>> Run a syntax check on the config file, I don't have a man page to
>>>> hand
>>>> but it's quite obvious what the option is.
>>>> syslog-ng has sometimes been picky about version numbers in the
>> past
>>>> and
>>>> it's tagged in the config file. Read the syntax check output
>>>> carefully
>>>> to see if anything is amiss.
>>>
>>> Thanks, Alan.
>>>
>>> The only unusual message is
>>> Systemd is not detected as the running init system;
>>>
>>> which is true since I still use openrc (but with systemd installed,
>> as
>>> well)
>>> Could this be the culprit?
>>
>>
>> I doubt it, I also use 3.6.1 without systemd.
>>
>> Please post eix syslog-ng so we can see how your USE is set up, and
>> your
>> syslog-ng.conf
>>
> Thanks, Alan.
>
> [U] app-admin/syslog-ng
>      Available versions:  3.4.7^t 3.4.8^t (~)3.5.6^t{tbz2}[1]
> (~)3.6.1^t{tbz2} {amqp caps dbi geoip ipv6 json mongodb pacct +pcre
> redis smtp spoof-source ssl systemd tcpd}
>      Installed versions:  3.5.6^t{tbz2}[1](05:21:52 PM 11/14/2014)(ipv6
> json pcre ssl systemd tcpd -amqp -caps -dbi -geoip -mongodb -pacct -
> smtp -spoof-source)
>      Homepage:            http://www.balabit.com/network-security/
> syslog-ng
>      Description:         syslog replacement with advanced filtering
> features


I don't find any info on what the syslog-ng ebuild does with
USE=systemd, I suspect it may want to use the fancy logging features
built into systemd.

Since you have it, but don't run it, does USE=-systemd fix the issue?


>
> And here are the config files (I've left out the commented lines)
>
> ================ /etc/syslog-ng/scl.conf =============================
> @define scl-root "`syslog-ng-data`/include/scl"
> @define include-path "`include-path`:`syslog-ng-data`/include"
>
> @include 'scl/system/plugin.conf'
> @include 'scl/pacct/plugin.conf'
> @include 'scl/syslogconf/plugin.conf'
>
> ================ /etc/syslog-ng/syslog-ng.conf =================
> options {
> 	threaded(yes);
> 	chain_hostnames(no);
> 	stats_freq(43200);
>
> 	mark_freq(3600);
> };
>
> source src { system(); internal(); };
>
> destination messages { file("/var/log/messages"); };
> destination console_all { file("/dev/tty12"); };
> log { source(src); destination(messages); };
> log { source(src); destination(console_all); };
>
>
> ================ /etc/conf.d/syslog-ng =================
> SYSLOG_NG_OPTS=""


That all looks normal, I don't see anything problematic there


-- 
Alan McKinnon
alan.mckinnon@×××××.com