Syslog-ng error

[tech_g706]

Hi,

I setup the syslog-ng to receive syslog from devices and splunk HF on the same server will read those logs files.

However I am not able to restart the syslog-ng and getting error.  syslog-ng is running as root and log file directory owned by splunk user.

Job for syslog-ng.service failed because the control process exited with error code.

and

systemctl status syslog-ng.service

× syslog-ng.service - System Logger Daemon
Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; preset: enabled)
Active: failed (Result: exit-code) since Sat 2025-04-05 11:39:04 UTC; 9s ago
Docs: man:syslog-ng(8)
Process: 1800 ExecStart=/usr/sbin/syslog-ng -F $SYSLOGNG_OPTS (code=exited, status=1/FAILURE)
Main PID: 1800 (code=exited, status=1/FAILURE)
Status: "Starting up... (Sat Apr 5 11:39:04 2025"
CPU: 4ms

Apr 05 11:39:04 if2 systemd[1]: syslog-ng.service: Scheduled restart job, restart counter is at 5.
Apr 05 11:39:04 if2 systemd[1]: syslog-ng.service: Start request repeated too quickly.
Apr 05 11:39:04 if2 systemd[1]: syslog-ng.service: Failed with result 'exit-code'.
Apr 05 11:39:04 if2 systemd[1]: Failed to start syslog-ng.service - System Logger Daemon.

[livehybrid · Accepted solution]

Hi @tech_g706 

Unfortunately I dont think you're going to get the best response here as not many users in this forum will have specific syslog-ng experience.

If it helps, I would start with checking the logs, try the following:

journalctl -xeu syslog-ng

🌟 Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[tech_g706]

Thanks for the response.

The issue has been resolved by creating a new configuration file and moving the configurations there. Syslog-ng was not letting me modify the default conf file.

[PickleRick]

This is actually syslog-ng's internal problem and has nothing to do with Splunk. Check system logs, check the syslog-ng configuration (I'm not a syslog-ng expert but I think it had an option to validate your configuration).