syslog-ng not starting

ugnius40 · November 19, 2010, 8:20am

Hi,
I’ve tried to install syslog-ng, but it does not start for me:

# you
# cat /etc/SuSE-release
openSUSE 11.3 (x86_64)
VERSION = 11.3

# uname -r
2.6.34.7-0.5-desktop

Installed via zypper, there are few custom startup scripts which give me some warnings but they should not interfere.:


# zypper in syslog-ng
Loading repository data...
Reading installed packages...
Resolving package dependencies...

The following NEW package is going to be installed:
  syslog-ng

1 new package to install.
Overall download size: 420.0 KiB. After the operation, additional 1.7 MiB will
be used.
Continue? [y/n/?] (y): y
Retrieving package syslog-ng-3.1.1-4.1.1.x86_64 (1/1), 420.0 KiB (1.7 MiB unpacked)
Retrieving: syslog-ng-3.1.1-4.1.1.x86_64.rpm [done (610.5 KiB/s)]
Installing: syslog-ng-3.1.1-4.1.1 [done]
Additional rpm output:
Updating etc/sysconfig/syslog...
insserv: warning: script 'S01rtorrent' missing LSB tags and overrides
insserv: warning: current start runlevel(s) (1 2 3 4 5) of script `syslog' overwrites defaults (2 3 5).
insserv: warning: current stop runlevel(s) (2 3 4 5) of script `syslog' overwrites defaults (2 3 5).
insserv: warning: script 'rtorrent' missing LSB tags and overrides
insserv: warning: script 'bridge' missing LSB tags and overrides
insserv: Default-Start undefined, assuming default start runlevel(s) for script `bridge'
Updating etc/sysconfig/syslog...
insserv: warning: script 'S01rtorrent' missing LSB tags and overrides
insserv: warning: script 'rtorrent' missing LSB tags and overrides
insserv: warning: script 'bridge' missing LSB tags and overrides
insserv: Default-Start undefined, assuming default start runlevel(s) for script `bridge'
Updating etc/sysconfig/syslog...

Did nothing to /ets/syslog-ng/syslog-ng.conf

Logged to webmin, refreshed modules and tried to start syslog-ng but got an error:

Failed to start Syslog-NG server :

Include file/directory not found; filename=’/var/run/syslog-ng/additional-log-sockets.conf’, error=‘No such file or directory (2)’

Also noted that there’s no /var/run/syslog-ng/ directory at all. But


# rmp -ql syslog-ng
says...
....
/var/run/syslog-ng

Is this something wrong with a what I’m doing, packaging error, apparmor rules or something else.

Any assistance would be appreciated.
Thank you.

czanik · November 19, 2010, 8:39am

Did you start syslog-ng by /etc/init.d/syslog? That should make sure, that the /var/run/syslog-ng directory is there together with the named file. This functionality is there to add log sources from chroots. If you don’t use bind, you can safely comment out the include line in syslog-ng.conf.

CzP

ugnius40 · November 19, 2010, 9:07am

Hi, thank you for reply,

I’ve just tried


# /etc/init.d/syslog restart

It did restart syslog daemon, but there’s still no syslog-ng directory
and


# ps ax | grep syslog
10658 ?        Sl     0:00 /sbin/rsyslogd -c 5 -f /etc/rsyslog.conf

Well, I do use bind, so I’m afraid to remove this line.

ken_yap · November 19, 2010, 9:16am

You’ll have to disable rsyslogd to use syslog-ng. They serve the same function and both listen on the same ports and sockets.

ugnius40 · November 19, 2010, 9:35am

Sorry but I’m completely clueless how to do that, chkconfig has only syslog entry, should’nt have syslog-ng modified syslog daemon scripts to launch syslog-ng, or do I have to do that by hand in some config file? I’ve tried restarting the whole thing, all the same. If I do remove rsyslog via zypper, not sure my system will even start after that.

ken_yap · November 19, 2010, 9:38am

I don’t know how either, but I suppose I could figure it out if I had to. But why do you need syslog-ng? rsyslog works fine.

czanik · November 19, 2010, 9:41am

Oh, I see. I was just planing to write a bug report about this: the installation of rsyslogd is hardcoded into base patterns If rsyslogd is present, then it is preferred by the startup scipt.

remove rsyslogd and lock/taboo it
or you can edit /etc/sysconfig/syslog and set SYSLOG_DAEMON to “syslog-ng”. But if rsyslogd is still on the system, it might be set back to an empty value or to rsyslogd, in which case rsyslogd starts.

I’ll check, but if you use bind, you might need to add its /dev/log socket to /etc/apparmor.d/sbin.syslog-ng or disable AppArmor.

CzP

ugnius40 · November 19, 2010, 9:49am

Ok,

Thanks for all replies, I just thought to use syslog-ng and webmin (to configure syslog-ng) to store logs from my cisco router, it seems not as easy as “zypper in”, I’ll try to configure normal syslog to do what I want.

Thanks again

czanik · November 19, 2010, 9:54am

Please try to go on with the syslog-ng package, that would help me to fix it for the next release!
CzP

ken_yap · November 19, 2010, 9:56am

rsyslog has routing rules also, but the language is different. There was another thread on the forum asking about the syntax. I used to have a syslog-ng rule for my router, but since I changed to using a dd-wrt based router, and since the logs are always boring, I haven’t bothered to make it work with rsyslog.

ugnius40 · November 19, 2010, 1:39pm

or you can edit /etc/sysconfig/syslog and set SYSLOG_DAEMON to “syslog-ng”. But if rsyslogd is still on the system, it might be set back to an empty value or to rsyslogd, in which case rsyslogd starts.

Hi,

Thanks for the tip about /etc/sysconfig/syslog file, it was as simple as that, I’ve stopped syslog, set SYSLOG_DAEMON=“syslog-ng” and started up syslog again.
Now syslog-ng seems to be running just fine.

Thanks.

robin_listas · November 19, 2010, 10:14pm

On 2010-11-19 08:36, ugnius40 wrote:
>
> Hi,
> I’ve tried to install syslog-ng, but it does not start for me: