Getting Data In

Syslog-ng error

tech_g706
Path Finder

Hi,

I setup the syslog-ng to receive syslog from devices and splunk HF on the same server will read those logs files.

However I am not able to restart the syslog-ng and getting error.  syslog-ng is running as root and log file directory owned by splunk user.

Job for syslog-ng.service failed because the control process exited with error code.

and

systemctl status syslog-ng.service

× syslog-ng.service - System Logger Daemon
Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; preset: enabled)
Active: failed (Result: exit-code) since Sat 2025-04-05 11:39:04 UTC; 9s ago
Docs: man:syslog-ng(8)
Process: 1800 ExecStart=/usr/sbin/syslog-ng -F $SYSLOGNG_OPTS (code=exited, status=1/FAILURE)
Main PID: 1800 (code=exited, status=1/FAILURE)
Status: "Starting up... (Sat Apr 5 11:39:04 2025"
CPU: 4ms

Apr 05 11:39:04 if2 systemd[1]: syslog-ng.service: Scheduled restart job, restart counter is at 5.
Apr 05 11:39:04 if2 systemd[1]: syslog-ng.service: Start request repeated too quickly.
Apr 05 11:39:04 if2 systemd[1]: syslog-ng.service: Failed with result 'exit-code'.
Apr 05 11:39:04 if2 systemd[1]: Failed to start syslog-ng.service - System Logger Daemon.

Labels (2)
0 Karma
1 Solution

livehybrid
Super Champion

Hi @tech_g706 

Unfortunately I dont think you're going to get the best response here as not many users in this forum will have specific syslog-ng experience.

If it helps, I would start with checking the logs, try the following:

journalctl -xeu syslog-ng

🌟 Did this answer help you? If so, please consider:

  • Adding kudos to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

livehybrid
Super Champion

Hi @tech_g706 

Unfortunately I dont think you're going to get the best response here as not many users in this forum will have specific syslog-ng experience.

If it helps, I would start with checking the logs, try the following:

journalctl -xeu syslog-ng

🌟 Did this answer help you? If so, please consider:

  • Adding kudos to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

tech_g706
Path Finder

Thanks for the response.

The issue has been resolved by creating a new configuration file and moving the configurations there. Syslog-ng was not letting me modify the default conf file.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

This is actually syslog-ng's internal problem and has nothing to do with Splunk. Check system logs, check the syslog-ng configuration (I'm not a syslog-ng expert but I think it had an option to validate your configuration).

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...