After upgrade to 23.05 RELEASE, Syslog-NG won't start

keyser

@provels I was just about to create a thread with the same headline :-)

Have two boxes, both shows the very same issue (Parsing error)

provels

service syslog-ng onestart

generates a more readable error.

[23.05-RELEASE][root@fw.workgroup]/root: service syslog-ng onestart
Starting syslog_ng.
Error parsing pragma, syntax error, unexpected invalid token, expecting LL_EOL in /usr/local/etc/syslog-ng.conf:3:13-3:14:
1       # This file is automatically generated by pfSense
2       # Do not edit manually !
3-----> @version:4.1.
3----->             ^
4       destination _DEFAULT { file("/HDD/data/var/syslog-ng/default.log"); };
5       log { source(_DEFAULT); destination(_DEFAULT); };
6       source _DEFAULT { internal(); syslog(transport(udp) port(5140) ip(127.0.0.1)); };

Error parsing config, syntax error, unexpected LL_ERROR, expecting end of file in /usr/local/etc/syslog-ng.conf:3:1-3:2:
1       # This file is automatically generated by pfSense
2       # Do not edit manually !
3-----> @version:4.1.
3-----> ^
4       destination _DEFAULT { file("/HDD/data/var/syslog-ng/default.log"); };
5       log { source(_DEFAULT); destination(_DEFAULT); };
6       source _DEFAULT { internal(); syslog(transport(udp) port(5140) ip(127.0.0.1)); };
<snip>
/usr/local/etc/rc.d/syslog-ng: WARNING: failed to start syslog_ng

but I don't understand the complaint.

EDIT - OK, I got it to start by editing /usr/local/etc/syslog-ng.conf and deleting the period at the end of line 3. Service will start then. HOWEVER, I still cannot do a save from the syslog-ng config page w/o seeing the same error. Likely an upstream problem in the prog that generates the "don't edit" config file.
Go figure, I'm just a hack.

3-----> @version:4.1.
3----->             ^

EDIT 2 - I think line 3 should be @version:4.1.1
EDIT 3 - The manual edit does not survive reboot.

keyser

@provels Good finding. I will create a redmine on the issue to see if there is a developer that can upstream a fix. I have no idea who maintains this package.

provels

@keyser Cool. But even after the edit, it will quit after a while. Dunno, I'm just a shoemaker.

Cylosoft

I was just looking for showstoppers on 23.05 for me. Looks like you found the only one for most of our boxes. Thanks for the post.

JonH

Thanks for posting here. I simply removed the package because I could not figure out "expecting LL_EOL". I plan to reinstall hoping that since the .conf is auto generated that it might work correctly. Maybe I'll wait awhile longer to see what other posts are made.

Cylosoft

Getting a little annoyed this isn't getting more high priority love from Netgate. We get told pfsense has limitations on log viewing because it's a firewall and to send logs elsewhere. The native syslog only supports UDP and remote logging basically requires TCP/SSL. So syslog-ng is a must. We upgraded a dozen boxes, but anything of any importance is stuck on 23.01 because of this. We need @jimp or someone from Netgate in this thread.

michmoor

@Cylosoft I know Jim is going to ask for a Redmine to be open if it hasnt been already so get that ready.

Cylosoft

@michmoor https://redmine.pfsense.org/issues/14407

keyser

@Cylosoft Yeah would be good to have it fixed soon. I too have a lot of boxes i cannot upgrade because I need secure TCP syslog collection from those boxes (and the other networking devices on the same site that forwards to SYSLOG-NG)

provels

@Cylosoft said in After upgrade to 23.05 RELEASE, Syslog-NG won't start:

@michmoor https://redmine.pfsense.org/issues/14407

Also https://redmine.pfsense.org/issues/14389

JonH

@keyser said in After upgrade to 23.05 RELEASE, Syslog-NG won't start:

Yeah would be good to have it fixed soon.

Both of the Redmine links are showing this fixed. Looks to me like it's avail in packages.

Cylosoft

Thanks @jimp !!! I upgraded a couple of boxes and the syslog-ng 1.16 you just released is working great. Much appreciated.

keyser

@JonH Thank you @jimp Excellent and very fast work. Works beautifully again :-)

provels

@jimp Yes, great work as always. All it takes is another one of us mooks to run your code and it's, "Oh, yeah, that..."!