topic Re: Syslog-ng error in Getting Data In

Syslog-ng error

tech_g706 — Sat, 05 Apr 2025 11:41:21 GMT

Hi,

I setup the syslog-ng to receive syslog from devices and splunk HF on the same server will read those logs files.

However I am not able to restart the syslog-ng and getting error. syslog-ng is running as root and log file directory owned by splunk user.

Job for syslog-ng.service failed because the control process exited with error code.

and

systemctl status syslog-ng.service

× syslog-ng.service - System Logger Daemon
Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; preset: enabled)
Active: failed (Result: exit-code) since Sat 2025-04-05 11:39:04 UTC; 9s ago
Docs: man:syslog-ng(8)
Process: 1800 ExecStart=/usr/sbin/syslog-ng -F $SYSLOGNG_OPTS (code=exited, status=1/FAILURE)
Main PID: 1800 (code=exited, status=1/FAILURE)
Status: "Starting up... (Sat Apr 5 11:39:04 2025"
CPU: 4ms

Apr 05 11:39:04 if2 systemd[1]: syslog-ng.service: Scheduled restart job, restart counter is at 5.
Apr 05 11:39:04 if2 systemd[1]: syslog-ng.service: Start request repeated too quickly.
Apr 05 11:39:04 if2 systemd[1]: syslog-ng.service: Failed with result 'exit-code'.
Apr 05 11:39:04 if2 systemd[1]: Failed to start syslog-ng.service - System Logger Daemon.

Re: Syslog-ng error

PickleRick — Sat, 05 Apr 2025 12:26:09 GMT

This is actually syslog-ng's internal problem and has nothing to do with Splunk. Check system logs, check the syslog-ng configuration (I'm not a syslog-ng expert but I think it had an option to validate your configuration).

Re: Syslog-ng error

livehybrid — Sat, 05 Apr 2025 15:11:11 GMT

Hi @tech_g706

Unfortunately I dont think you're going to get the best response here as not many users in this forum will have specific syslog-ng experience.

If it helps, I would start with checking the logs, try the following:

journalctl -xeu syslog-ng

🌟 Did this answer help you? If so, please consider:

Adding kudos to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Syslog-ng error

tech_g706 — Sat, 05 Apr 2025 16:29:45 GMT

Thanks for the response.

The issue has been resolved by creating a new configuration file and moving the configurations there. Syslog-ng was not letting me modify the default conf file.