Eu não consigo iniciar o syslog-ng quando o apparmor está em execução porque ele reclama que não consegue encontrar o plugin do sistema:
service apparmor start
* Starting AppArmor ...
* Loading AppArmor profiles ...
serviço syslog-ng restart
- WARNING: you are stopping a boot service * Stopping syslog-ng ...
[ ok ] * Checking your configfile (/etc/syslog-ng/syslog-ng.conf) ...
Error parsing source, source plugin system not found in
/etc/syslog-ng/syslog-ng.conf at line 24, column 14:
source src { system(); internal(); };
^^^^^^
syslog-ng documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng
mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng *
Configuration error. Please fix your configfile
(/etc/syslog-ng/syslog-ng.conf)
[ !! ] * ERROR: syslog-ng failed to start
Agora, uma vez que paro de aparentar:
service apparmor stop
* Stopping AppArmor ...
* Unloading AppArmor profiles
service syslog-ng restart
* Checking your configfile (/etc/syslog-ng/syslog-ng.conf) ... [ ok ]
* Starting syslog-ng ...
Esta é a minha regra apparmor syslog-ng:
# ------------------------------------------------------------------
#
# Copyright (C) 2006-2009 Novell/SUSE
# Copyright (C) 2006 Christian Boltz
# Copyright (C) 2010 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
#include <tunables/global>
#define this to be where syslog-ng is chrooted
@{CHROOT_BASE}=""
profile syslog-ng /{usr/,}sbin/syslog-ng {
#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/nameservice>
#include <abstractions/mysql>
#include <abstractions/openssl>
capability chown,
capability dac_override,
capability dac_read_search,
capability fsetid,
capability fowner,
capability sys_tty_config,
capability sys_resource,
capability syslog,
unix (receive) type=dgram,
unix (receive) type=stream,
/dev/kmsg r,
/dev/log w,
/dev/syslog w,
/dev/tty10 rw,
/dev/xconsole rw,
/etc/machine-id r,
/etc/syslog-ng/* r,
/etc/syslog-ng/conf.d/ r,
/etc/syslog-ng/conf.d/* r,
@{PROC}/kmsg r,
/etc/hosts.deny r,
/etc/hosts.allow r,
/{usr/,}sbin/syslog-ng mr,
/sys/devices/system/cpu/online r,
/usr/share/syslog-ng/** r,
/usr/lib/syslog-ng/** r,
/usr/lib64/syslog-ng/** r,
/usr/share/include/scl/** r,
/var/lib/syslog-ng/syslog-ng-?????.qf rw,
# chrooted applications
@{CHROOT_BASE}/var/lib/*/dev/log w,
@{CHROOT_BASE}/var/lib/syslog-ng/syslog-ng.persist* rw,
@{CHROOT_BASE}/var/log/** w,
@{CHROOT_BASE}/{,var/}run/syslog-ng.pid krw,
@{CHROOT_BASE}/{,var/}run/syslog-ng.ctl rw,
@{CHROOT_BASE}/usr/lib/syslog-ng/** r,
@{CHROOT_BASE}/usr/lib64/syslog-ng/** r,
@{CHROOT_BASE}/usr/share/include/scl/** r,
/{var,var/run,run}/log/journal/ r,
/{var,var/run,run}/log/journal/*/ r,
/{var,var/run,run}/log/journal/*/*.journal r,
/{var/,}run/syslog-ng.ctl a,
/{var/,}run/syslog-ng/additional-log-sockets.conf r,
# Site-specific additions and overrides. See local/README for details.
#include <local/sbin.syslog-ng>
}
NOTA 1: Eu editei isto porque eu tentei a solução abaixo, eu adicionei o / dev / kmsg r, à lista de permissões que o syslog-ng requer e acabei com o mesmo problema. Também devo observar que estou no funtoo / gentoo linux com uma raiz do squashfs apoiada por um overlayfs EXT4. Vou checar a saída da strace.
NOTA 2: Eu corri strace e não estou vendo nada óbvio, estou usando strace syslog-ng. Se eu comentar o problema no arquivo de configuração syslog-ng.conf, ele tropeça no destino. Ambos devem ser suportados em / usr / lib64 / syslog-ng / ** r, certo?
strace (truncado):
access("/etc/syslog-ng/scl/*/*.conf", F_OK) = -1 ENOENT (No such file or directory)
access("/usr/share/include/scl/*/*.conf", F_OK) = -1 ENOENT (No such file or directory)
open("/etc/syslog-ng/scl", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/usr/share/include/scl", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 EACCES (Permission denied)
write(2, "[2017-12-25T11:13:53.068758] Err"..., 128[2017-12-25T11:13:53.068758] Error processing path for inclusion; path='/usr/share/include/scl', errno='Permission denied (13)'
) = 128
write(2, "[2017-12-25T11:13:53.068790] Fin"..., 94[2017-12-25T11:13:53.068790] Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1'
) = 94
close(11) = 0
write(2, "[2017-12-25T11:13:53.068844] Rea"..., 93[2017-12-25T11:13:53.068844] Reading path for candidate modules; path='/usr/lib64/syslog-ng'
) = 93
open("/usr/lib64/syslog-ng", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 EACCES (Permission denied)
open("/usr/lib64/charset.alias", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/lib64/gconv/gconv-modules.cache", O_RDONLY) = 11
fstat(11, {st_mode=S_IFREG|0644, st_size=26244, ...}) = 0
mmap(NULL, 26244, PROT_READ, MAP_SHARED, 11, 0) = 0x7f1df6c84000
close(11) = 0
futex(0x7f1df62928e8, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f1df67c0428, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f1df67c0428, FUTEX_WAKE_PRIVATE, 2147483647) = 0
open("/proc/self/maps", O_RDONLY|O_CLOEXEC) = 11
fstat(11, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(11, "00400000-00402000 r-xp 00000000 "..., 1024) = 1024
read(11, "r--p 00004000 fe:02 7236 "..., 1024) = 1024
read(11, " /lib64/libdl-2.23.so\n7f1df4"..., 1024) = 1024
read(11, " /usr/lib64/lib"..., 1024) = 1024
read(11, "ib64/libgthread-2.0.so.0.4800.2\n"..., 1024) = 1024
read(11, "--p 00006000 fe:02 7273 "..., 1024) = 1024
read(11, "0 \n7f1df64b3000-7f1df65bf000 r-x"..., 1024) = 1024
close(11) = 0
write(2, "Error parsing source, source plu"..., 109Error parsing source, source plugin system not found in /etc/syslog-ng/syslog-ng.conf at line 24, column 14:
) = 109
open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 11
fstat(11, {st_mode=S_IFREG|0644, st_size=1498, ...}) = 0
read(11, "@version: 3.7\n#\n# Syslog-ng defa"..., 4096) = 1498
close(11) = 0
write(2, "\nsource src { system(); internal"..., 39
source src { system(); internal(); };
) = 39
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, "^", 1^) = 1
write(2, "^", 1^) = 1
write(2, "^", 1^) = 1
write(2, "^", 1^) = 1
write(2, "^", 1^) = 1
write(2, "^", 1^) = 1
write(2, "\n", 1
) = 1
write(2, "\nsyslog-ng documentation: http:/"..., 156
syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng
) = 156
close(10) = 0
exit_group(1) = ?
+++ exited with 1 +++
syslog-ng.conf:
@version: 3.7
@include "scl.conf"
options {
threaded(yes);
chain_hostnames(no);
stats_freq(43200);
mark_freq(3600);
};
source src { system(); internal(); };
destination messages { file("/var/log/messages" owner("logstash") group("logstash"));};
log { source(src); destination(messages); };
destination remote_log_server {udp("router" port(514));};
log { source(src); destination(remote_log_server); };