Questions[syslog-ng](server)

Right now I'm running syslog-ng 3 (3.35.1) on Ubuntu 22.04.1 LTS. The goal is to use https secured protocol to send data and to use basic authentication. Syslog-ng is sending properly logs to Elasticsearch API using elasticsearch-http module as shown below:

destination elk_http {
  elasticsearch-http(
    index("testing_index")
    type("")
    url("http://a.b.c.d:port/_bulk")
    workers(4)
);
};

Now I have to change destination address from http to https and as far as I know there will be no problems, but how can I configure basic auth ? I was trying to google for solution but I have only found examples with elasticsearch2 module (@module mod-java). The problem is that I can not install elasticsearch2 module in any way (apt-get install syslog-ng-mod-elasticsearch, apt-get install syslog-ng-mod-java and so on). Is there any way to enable basic auth with 'elasticsearch-http' module or if not do i have to install syslog-ng with sources and then enable mod-java or maybe there simple way to install mod-java ?

If you have any ideas please let me know.

Regards

journald does everything I need except listen on the UDP port. I want to use syslog-ng as a forwarder from the UDP port to journald. There's a simple program called 'udp514-journal' that can handle this. However, syslog-ng seems more reliable and functionally capable (with TLS encryption and filters). There are many examples of how to forward logs from journald to syslog-ng, but I'm trying to achieve the opposite. Is this possible?

We currently use logger to get our Apache access logs to syslog-ng with a line like this one in each vhost:

CustomLog "|/usr/bin/logger -p local1.info  -t www_main" combined

It seems that almost every tutorial or advice I can find regarding Apache and syslog-ng uses this method to get the logs into syslog-ng. (Example). The rest use named pipes and the pipe() source. (Example).

The trouble with this is that logger splits any lines longer than 1024 bytes and sends them as separate log entries, meaning that some log entries end up on separate lines in the final destination log file on the logging box.

Using a named pipe and the pipe() source in syslog-ng solves the split lines problem but comes with its own set of minor problems and annoyances. To name a few, the named pipe has to be created before both Apache and syslog-ng are started, syslog-ng must be started before Apache is started and tagging the logs (which is done above with -t) must now be done in the syslog-ng configuration file rather than in the vhost.

This page suggests writing a short Perl script to use in place of /usr/bin/logger.

I was wondering if anyone knows of any alternatives to logger, preferably written in a natively compiled language or maybe an updated version of logger that doesn't split long lines in half.

I would also be interested in hearing of any other solutions to the problem of long log lines being split, such as a way of combining them back together using syslog-ng once they reach the logs servers.

I'm attempting to install and run syslog-ng but I'm blocked with the following error.

Error opening configuration file; filename='/etc/syslog-ng/syslog-ng.conf', error='Permission denied (13)'

I'm running this with sudo and the file and directory now both have 777 permissions. I've used strace and it's definitely an open call that's failing with EACCESS. As far as we can tell it does not change to be another user.

Update: As requested: strace output

[edward.sargisson@apps-mgmt-fe1 syslog-ng]$ sudo strace -f -v -eopen /etc/init.d/syslog-ng start
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib64/libtermcap.so.2", O_RDONLY) = 3
open("/lib64/libdl.so.2", O_RDONLY)     = 3
open("/lib64/libc.so.6", O_RDONLY)      = 3
open("/dev/tty", O_RDWR|O_NONBLOCK)     = 3
open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
open("/proc/meminfo", O_RDONLY)         = 3
open("/usr/lib64/gconv/gconv-modules.cache", O_RDONLY) = 3
open("/etc/init.d/syslog-ng", O_RDONLY) = 3
open("/etc/init.d/functions", O_RDONLY) = 3
Process 4802 attached (waiting for parent)
Process 4802 resumed (parent 4801 ready)
Process 4803 attached (waiting for parent)
Process 4803 resumed (parent 4802 ready)
Process 4802 suspended
[pid  4803] open("/etc/ld.so.cache", O_RDONLY) = 3
[pid  4803] open("/lib64/libc.so.6", O_RDONLY) = 3
Process 4802 resumed
Process 4803 detached
[pid  4802] --- SIGCHLD (Child exited) @ 0 (0) ---
Process 4802 detached
--- SIGCHLD (Child exited) @ 0 (0) ---
open("/etc/profile.d/lang.sh", O_RDONLY) = 3
open("/etc/sysconfig/i18n", O_RDONLY)   = 3
open("/etc/sysconfig/init", O_RDONLY)   = 3
open("/usr/share/locale/locale.alias", O_RDONLY) = 3
open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/initscripts.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.utf8/LC_MESSAGES/initscripts.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US/LC_MESSAGES/initscripts.mo", O_RDONLY) = -1 ENOENT (No    such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/initscripts.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/initscripts.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/initscripts.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/etc/sysconfig/syslog-ng", O_RDONLY) = 3
Process 4804 attached (waiting for parent)
Process 4804 resumed (parent 4801 ready)
Process 4801 suspended
[pid  4804] open("/etc/ld.so.cache", O_RDONLY) = 3
[pid  4804] open("/lib64/libnsl.so.1", O_RDONLY) = 3
[pid  4804] open("/lib64/librt.so.1", O_RDONLY) = 3
[pid  4804] open("/lib64/libnet.so.1", O_RDONLY) = 3
[pid  4804] open("/lib64/libdl.so.2", O_RDONLY) = 3
[pid  4804] open("/lib64/libc.so.6", O_RDONLY) = 3
[pid  4804] open("/lib64/libpthread.so.0", O_RDONLY) = 3
[pid  4804] open("/etc/eventlog.conf", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid  4804] open("/etc/localtime", O_RDONLY) = 3
[pid  4804] open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = -1 EACCES (Permission denied)
Error opening configuration file; filename='/etc/syslog-ng/syslog-ng.conf', error='Permission denied (13)'
Process 4801 resumed
Process 4804 detached
--- SIGCHLD (Child exited) @ 0 (0) ---

As a test, we moved the syslog-ng.conf somewhere and copied it back - which made it work but doesn't help. If I use chef to replace the file then syslog-ng will not start.

If anyone has got syslog-ng working on Solaris 10, do you have a set of instructions I could follow to get it installed and working?

I tried following this http://opensystems.wordpress.com/2006/06/01/replacing-syslog-on-solaris-10-with-syslog-ng/ but got stuck with the syslog-ng service stuck restarting with no indication of why.

Thanks for any help. NickB