Local sources seem not to be working

Alexandre Santos <[email protected]>
Newsgroups gmane.comp.syslog-ng
Message-ID <CO6PR10MB56029F131326CC5703182CF3D0109@CO6PR10MB5602.namprd10.prod.outlook.com>
Hi,

I have syslog-ng 3.32.1 running in a Debian GNU/Linux 10 (buster) with the configuration in the attachement.

After sometime running, syslog-ng seems be unable to read from system() and internal() sources.
Log messages from syslog(ip(10.20.30.40) transport("udp") port(514) keep-alive(no)); are seen in the output folders.
Also journald logs are working fine.

After a reload of configuration in which what changes is this line:
rewrite r_host { set("MACHINE-${HOST}", value("HOST")); };
logging is resumed.

Here is the time gap for logs:
<43>1 2022-03-11T11:55:23.802+00:00 xmm4-1-1 syslog-ng 8283 - [meta sequenceId="767"] Last message 'Destination reliable' repeated 8933 times, suppressed by syslog-ng on xmm4-1-1
<46>1 2022-03-14T07:19:01.817+00:00 xmm4-1-1 syslog-ng 8283 - [meta sequenceId="1"] Module loaded and initialized successfully; module='syslogformat'

Do you know why this is happening?

Thanks & Regards,
Alex

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq
42116.syslog-ng.conf (application/octet-stream, 13.5 KB)
@version: 3.32

# First, set some global options.
options {
    chain_hostnames(off);
    flush_lines(0);
    use_dns(no);
    use_fqdn(no);
    owner("root");
    group("root");
    perm(0644);
    stats_freq(0);
    bad_hostname("^gconfd$");
    ts-format("iso");
    time_zone("UTC");
    mark-freq(0);
    frac-digits(3);
    keep-hostname(yes);
};

# common block end


source s_src {
    system();
    internal();
    syslog(ip(10.20.30.40) transport("udp") port(514) keep-alive(no));
};

rewrite r_host { set("MACHINE-${HOST}", value("HOST")); };

# localFile: apps
destination d_localfile_apps {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/apps.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_apps_local7 {
    facility(local7) and level(info .. emerg);
};
filter f_localfile_apps {
    filter(f_localfile_apps_local7); };
log {
    source(s_src);
    filter(f_localfile_apps);
    destination(d_localfile_apps);
    flags(flow-control);
};
# end of localFile: apps

# localFile: kernel
destination d_localfile_kernel {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/kernel.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_kernel_kern {
    facility(kern) and level(info .. emerg);
};
filter f_localfile_kernel {
    filter(f_localfile_kernel_kern); };
log {
    source(s_src);
    filter(f_localfile_kernel);
    destination(d_localfile_kernel);
    flags(flow-control);
};
# end of localFile: kernel

# localFile: messages
destination d_localfile_messages {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/messages.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_messages_mail {
    facility(mail) and level(info .. emerg);
};
filter f_localfile_messages_daemon {
    facility(daemon) and level(info .. emerg);
};
filter f_localfile_messages_syslog {
    facility(syslog) and level(info .. emerg);
};
filter f_localfile_messages_lpr {
    facility(lpr) and level(info .. emerg);
};
filter f_localfile_messages_uucp {
    facility(uucp) and level(info .. emerg);
};
filter f_localfile_messages_cron {
    facility(cron) and level(info .. emerg);
};
filter f_localfile_messages_ftp {
    facility(ftp) and level(info .. emerg);
};
filter f_localfile_messages_ntp {
    facility(ntp) and level(info .. emerg);
};
filter f_localfile_messages_security {
    facility(security) and level(info .. emerg);
};
filter f_localfile_messages_console {
    facility(console) and level(info .. emerg);
};
filter f_localfile_messages_solaris-cron {
    facility(solaris-cron) and level(info .. emerg);
};
filter f_localfile_messages {
    filter(f_localfile_messages_mail) or filter(f_localfile_messages_daemon) or filter(f_localfile_messages_syslog) or filter(f_localfile_messages_lpr) or filter(f_localfile_messages_uucp) or filter(f_localfile_messages_cron) or filter(f_localfile_messages_ftp) or filter(f_localfile_messages_ntp) or filter(f_localfile_messages_security) or filter(f_localfile_messages_console) or filter(f_localfile_messages_solaris-cron); };
log {
    source(s_src);
    filter(f_localfile_messages);
    destination(d_localfile_messages);
    flags(flow-control);
};
# end of localFile: messages

# localFile: security
destination d_localfile_security {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/security.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_security_auth {
    facility(auth) and level(info .. emerg);
};
filter f_localfile_security_authpriv {
    facility(authpriv) and level(info .. emerg);
};
filter f_localfile_security {
    filter(f_localfile_security_auth) or filter(f_localfile_security_authpriv); };
log {
    source(s_src);
    filter(f_localfile_security);
    destination(d_localfile_security);
    flags(flow-control);
};
# end of localFile: security

# localFile: user
destination d_localfile_user {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/user.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_user_user {
    facility(user) and level(info .. emerg);
};
filter f_localfile_user {
    filter(f_localfile_user_user); };
log {
    source(s_src);
    filter(f_localfile_user);
    destination(d_localfile_user);
    flags(flow-control);
};
# end of localFile: user

# localFile: alarm
destination d_localfile_alarm {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/alarm.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_alarm_local1 {
    facility(local1) and level(info .. emerg);
};
filter f_localfile_alarm {
    filter(f_localfile_alarm_local1); };
log {
    source(s_src);
    filter(f_localfile_alarm);
    destination(d_localfile_alarm);
    flags(flow-control);
};
# end of localFile: alarm

# localFile: cli-command
destination d_localfile_cli-command {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/cli-command.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_cli-command_match {
    match("<CLI>" value("MESSAGE"));
};
filter f_localfile_cli-command_local3 {
    facility(local3) and level(info .. emerg) and filter(f_localfile_cli-command_match);
};
filter f_localfile_cli-command {
    filter(f_localfile_cli-command_local3); };
log {
    source(s_src);
    filter(f_localfile_cli-command);
    destination(d_localfile_cli-command);
    flags(flow-control);
};
# end of localFile: cli-command

# localFile: configuration
destination d_localfile_configuration {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/configuration.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_configuration_local2 {
    facility(local2) and level(info .. emerg);
};
filter f_localfile_configuration {
    filter(f_localfile_configuration_local2); };
log {
    source(s_src);
    filter(f_localfile_configuration);
    destination(d_localfile_configuration);
    flags(flow-control);
};
# end of localFile: configuration

# localFile: event
destination d_localfile_event {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/event.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_event_local6 {
    facility(local6) and level(info .. emerg);
};
filter f_localfile_event {
    filter(f_localfile_event_local6); };
log {
    source(s_src);
    filter(f_localfile_event);
    destination(d_localfile_event);
    flags(flow-control);
};
# end of localFile: event

# localFile: grpc-command
destination d_localfile_grpc-command {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/grpc-command.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_grpc-command_match {
    match("<GRPC>" value("MESSAGE"));
};
filter f_localfile_grpc-command_local3 {
    facility(local3) and level(info .. emerg) and filter(f_localfile_grpc-command_match);
};
filter f_localfile_grpc-command {
    filter(f_localfile_grpc-command_local3); };
log {
    source(s_src);
    filter(f_localfile_grpc-command);
    destination(d_localfile_grpc-command);
    flags(flow-control);
};
# end of localFile: grpc-command

# localFile: linecard
destination d_localfile_linecard {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/linecard.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_linecard_local4 {
    facility(local4) and level(info .. emerg);
};
filter f_localfile_linecard {
    filter(f_localfile_linecard_local4); };
log {
    source(s_src);
    filter(f_localfile_linecard);
    destination(d_localfile_linecard);
    flags(flow-control);
};
# end of localFile: linecard

# localFile: netconf-command
destination d_localfile_netconf-command {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/netconf-command.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_netconf-command_match {
    match("<NETCONF>" value("MESSAGE"));
};
filter f_localfile_netconf-command_local3 {
    facility(local3) and level(info .. emerg) and filter(f_localfile_netconf-command_match);
};
filter f_localfile_netconf-command {
    filter(f_localfile_netconf-command_local3); };
log {
    source(s_src);
    filter(f_localfile_netconf-command);
    destination(d_localfile_netconf-command);
    flags(flow-control);
};
# end of localFile: netconf-command

# localFile: shell-command
destination d_localfile_shell-command {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/shell-command.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_shell-command_match {
    match("<SHELL>" value("MESSAGE"));
};
filter f_localfile_shell-command_local3 {
    facility(local3) and level(info .. emerg) and filter(f_localfile_shell-command_match);
};
filter f_localfile_shell-command {
    filter(f_localfile_shell-command_local3); };
log {
    source(s_src);
    filter(f_localfile_shell-command);
    destination(d_localfile_shell-command);
    flags(flow-control);
};
# end of localFile: shell-command

# localFile: sysinfo
destination d_localfile_sysinfo {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/sysinfo.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_sysinfo_local5 {
    facility(local5) and level(info .. emerg);
};
filter f_localfile_sysinfo {
    filter(f_localfile_sysinfo_local5); };
log {
    source(s_src);
    filter(f_localfile_sysinfo);
    destination(d_localfile_sysinfo);
    flags(flow-control);
};
# end of localFile: sysinfo

# localFile: tl1-command
destination d_localfile_tl1-command {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/tl1-command.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_tl1-command_match {
    match("<TL1>" value("MESSAGE"));
};
filter f_localfile_tl1-command_local3 {
    facility(local3) and level(info .. emerg) and filter(f_localfile_tl1-command_match);
};
filter f_localfile_tl1-command {
    filter(f_localfile_tl1-command_local3); };
log {
    source(s_src);
    filter(f_localfile_tl1-command);
    destination(d_localfile_tl1-command);
    flags(flow-control);
};
# end of localFile: tl1-command

# localFile: ztp
destination d_localfile_ztp {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/ztp.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_ztp_match {
    match("<ZTP>" value("MESSAGE"));
};
filter f_localfile_ztp_local7 {
    facility(local7) and level(info .. emerg) and filter(f_localfile_ztp_match);
};
filter f_localfile_ztp {
    filter(f_localfile_ztp_local7); };
log {
    source(s_src);
    filter(f_localfile_ztp);
    destination(d_localfile_ztp);
    flags(flow-control);
};
# end of localFile: ztp


destination d_mgmt_vrf_socket {
    unix-stream("/dev/uds_log"
        flags(syslog-protocol, no-multi-line)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
log {
    source(s_src);
    rewrite(r_host);
    destination(d_mgmt_vrf_socket);
};
42116.syslog-ng.log.gz (application/x-gzip, 226.4 KB) - not displayed
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.