syslog-ng package problems

andym · 2024-10-14 14:54:05

There are multiple errors reported by syslog-ng when starting:

Error opening plugin module; module='afmongodb'
Error opening plugin module; module='afsmtp'
Error opening plugin module; module='afamqp'
Error opening plugin module; module='kafka'
Error opening plugin module; module='redis'

Since syslog-ng was updated to 4.8.0 it no longer logs anything by default.

I logged these as problems at https://github.com/syslog-ng and they say that these have been introduced by the arch linux packagers.

My comments with regard to the Error Messages are:

Since, in all cases, syslog-ng says 'cannot open shared object file: No such file or directory' I presume these should all be Warnings, at the most, certainly not errors.
The error would only occur if the shared object file existed and the module was not available.

and regarding installing syslog-ng with no default logging:

Is it really wise to allow the installation of a syslog facility that logs absolutely nothing by default?

amatriain · 2024-10-14 16:58:55

I've also realized today that syslog-ng has been logging absolutely nothing in my systems for some time (zero-byte files in /var/log). This is a big problem and I don't think it was properly announced, I don't think a post-upgrade message is enough to communicate that all syslog logging was turned off by default. The wiki page doesn't explain this either.

The culprit is this commit in arch repo: https://gitlab.archlinux.org/archlinux/ … 738c3839c3 in which syslog-ng.conf was replaced. The old version had all logging enabled, the new version has all filter and destination lines inside the log statements commented out, which disables all logging.

The fix is to uncomment all filter and destination lines (except the source(s_network) line and the destination line under it, which will not be desired in most cases) and restart syslog-ng@default.service. Actually I think that should be the default configuration when installing the syslog-ng package, which would keep the previous behavior that most users will want.

andym · 2024-10-14 17:32:27

Actually I think that should be the default configuration when installing the syslog-ng package, which would keep the previous behavior that most users will want.

Agreed, or at least minimal loging as syslog-ng provides if installed from github

Last edited by andym (2024-10-14 17:33:53)

Lone_Wolf · 2024-10-15 09:29:51

amatriain wrote:

I've also realized today that syslog-ng has been logging absolutely nothing in my systems for some time (zero-byte files in /var/log). This is a big problem and I don't think it was properly announced, I don't think a post-upgrade message is enough to communicate that all syslog logging was turned off by default. The wiki page doesn't explain this either.

Unfortunately AL syslog-ng maintainers needed convincing to add the post-upgrade message and felt that was enough.
https://gitlab.archlinux.org/archlinux/ … -/issues/2 .

It's been years since I added anything to the wiki, I hoped other syslog-ng users would look at (closed) bugreports.

Scimmia · 2024-10-15 09:33:52

It's been said many times, if you don't read what pacman tells you, things will break. There's really not much more that can be done to announce it for a package like this that doesn't get much use these days.

andym · 2024-10-15 09:51:15

Neither of these last two comments answer the questions.

Why distribute a syslog package with default settings that do no logging? If the default configuration from the developers is flawed, distribute a corrected configuration, not one that does nothing.

@scimmia or delete the package altogether from the distro.

No comments on the "Errors" reports?

Lone_Wolf · 2024-10-15 10:14:04

You people did read the bugreport and noticed there were atleast 2 versions of syslog-ng 8 in extra-repo that changed the behaviour without any notice from pacman ?

andym wrote:

Why ....

Try asking the archlinux syslog-ng maintainers.

Added
about the errrors :
full syslog-ng / journalctl -b output please.

Last edited by Lone_Wolf (2024-10-15 10:16:43)

andym · 2024-10-15 10:29:13

Try asking the archlinux syslog-ng maintainers.

I will

Errors:

Error opening plugin module; module='afmongodb', error='libmongoc-1.0.so.0: cannot open shared object file: No such file or directory'
Error opening plugin module; module='afsmtp', error='libesmtp.so.6.2.0: cannot open shared object file: No such file or directory'
Error opening plugin module; module='afamqp', error='librabbitmq.so.4: cannot open shared object file: No such file or directory'
Error opening plugin module; module='kafka', error='librdkafka.so.1: cannot open shared object file: No such file or directory'
Error opening plugin module; module='redis', error='libhiredis.so.1.1.0: cannot open shared object file: No such file or directory'

So it is apparent that the shared object file does not exist, so the module is not needed. As I see it this is not an error, in fact I do not see that there is a need to report it at all. If it is thought to be interesting, then surely it should be a Warning and not an Error.

andym · 2024-10-15 10:39:16

@Lone_Wolf - did you try Artix Linux?

pezz · 2024-10-15 10:47:49

I agree with your general thoughts and sentiment andym, but still, you run Arch.

Sometimes it's on you as the user to get the job done.

Lone_Wolf · 2024-10-16 09:25:19

 pacman -F libmongoc-1.0.so.0
extra/mongo-c-driver 1.28.0-1
    usr/lib/libmongoc-1.0.so.0
$

mongo-c-driver is an optional dep for syslog-ng and apparently not present on your system.
Maybe it can be disabled in the config ?

offtopic

andym wrote:

@Lone_Wolf - did you try Artix Linux?

I like being an aur maintainer and that means i have to be able to build in clean chroot using archlinux package devtools which requires base-devel which requires systemd .
Last time I checked (several years ago) artix init systems didn't support running systemd in a chroot .
Has that changed ?

Last edited by Lone_Wolf (2024-10-16 09:26:01)

andym · 2024-10-16 11:41:55

mongo-c-driver is an optional dep for syslog-ng and apparently not present on your system.

Exactly, not an error then, so why the error message? According to the syslog-ng developers the error message was introduced by the arch packagers.

Thank you for all the interesting responses. I think the point has been made. Now it is up to the packagers.

seth · 2024-10-16 12:30:20

According to the syslog-ng developers the error message was introduced by the arch packagers.

With what reasoning? The *plugins* being an optional dependency?
I doubt that the syslog code behavior has been altered downstream itr.

The loader will get an ENOENT and use some generic error printing function to record that.
In that case the code technically hits an error, just not a critical one and it can continue gracefully - the stanze isn't all that uncommon, though.

RRZ · 2024-11-10 11:01:51

Thank you very much for addressing this topic! Solved the issue I was having (not logging for weeks)!

Ron

grat · 2025-01-03 07:38:21

What an incredibly stupid, short-sighted decision. If I have explicitly installed syslog-ng, wouldn't you think I would actually WANT logging enabled by default?

Worse, having installed syslog-ng in a functional form using the then-defaults, now that I've upgraded, I have lost the logging that I've had for the past year or more, and there was no popup message during install saying "By the way, we just BROKE this package that's been working for years!" (I see the post-install message, but I didn't see it when I did the update).

I manage hundreds of linux systems, running Red Hat, Debian, Ubuntu, Mint, and SuSE, with syslog-ng being our logging solution of choice (It's easy to centralize)-- And Arch is the first time I've had to do major editing to a config file to make the installed package actually do anything.

skunktrader · 2025-01-03 07:59:43

It shouldn't take you too long to get the config from one of the hundreds of systems that you manage that are working and merge the settings

andym · 2025-01-03 08:32:18

@grat

I manage hundreds of linux systems, running Red Hat, Debian, Ubuntu, Mint, and SuSE, with syslog-ng being our logging solution of choice

So, no doubt you monitor all the error messages. Perhaps you could also report the problem created for users/administrators when "Warnings" messages are reported as "Errors"?
I reported it at the syslog-ng github site, as well as here.

seth · 2025-01-03 09:18:05

tbf, the decision to replace the downstream config w/ the upstream one, but then patch-customize it, but only partially re-establish the status quo ante is quite an odd one and the idea behind it has so far escaped me.

However

I have lost the logging that I've had for the past year or more

I do not understand how any of this would have caused the loss of previous logs (leaving aside the usual quips about of having concepts of a plan for backups )

andym · 2025-01-03 09:28:57

I have lost the logging that I've had for the past year or more

I think the op probably meant the "logging options", not the logs

Arch Linux

#1 2024-10-14 14:54:05

syslog-ng package problems

#2 2024-10-14 16:58:55

Re: syslog-ng package problems

#3 2024-10-14 17:32:27

Re: syslog-ng package problems

#4 2024-10-15 09:29:51

Re: syslog-ng package problems

#5 2024-10-15 09:33:52

Re: syslog-ng package problems

#6 2024-10-15 09:51:15

Re: syslog-ng package problems

#7 2024-10-15 10:14:04

Re: syslog-ng package problems

#8 2024-10-15 10:29:13

Re: syslog-ng package problems

#9 2024-10-15 10:39:16

Re: syslog-ng package problems

#10 2024-10-15 10:47:49

Re: syslog-ng package problems

#11 2024-10-16 09:25:19

Re: syslog-ng package problems

#12 2024-10-16 11:41:55

Re: syslog-ng package problems

#13 2024-10-16 12:30:20

Re: syslog-ng package problems

#14 2024-11-10 11:01:51

Re: syslog-ng package problems

#15 2025-01-03 07:38:21

Re: syslog-ng package problems

#16 2025-01-03 07:59:43

Re: syslog-ng package problems

#17 2025-01-03 08:32:18

Re: syslog-ng package problems

#18 2025-01-03 09:18:05

Re: syslog-ng package problems

#19 2025-01-03 09:28:57

Re: syslog-ng package problems

Board footer