O serviço Syslog não inicia

Question

Instalei o syslog-ng 3.5 no Debian Jessie do RasperryPi. Quando tento iniciar o serviço, ele falha

-- Unit syslog.socket has begun starting up.
Feb 10 12:29:28 blackbox systemd[1]: Socket service syslog.service not loaded, r
Feb 10 12:29:28 blackbox systemd[1]: Failed to listen on Syslog Socket.
-- Subject: Unit syslog.socket has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit syslog.socket has failed.
--
-- The result is failed.
Feb 10 12:29:28 blackbox systemd[1]: Starting System Logger Daemon...
-- Subject: Unit syslog-ng.service has begun with start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit syslog-ng.service has begun starting up.
Feb 10 12:29:29 blackbox systemd[1]: Started System Logger Daemon.
-- Subject: Unit syslog-ng.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit syslog-ng.service has finished starting up.
--
-- The start-up result is done.

Eu verifiquei o netstat e a porta 514 não é usada por outro processo. Esta é a configuração que usei, que funcionou bem com uma versão mais antiga:

source s_net { udp(ip(0.0.0.0) port(514)); };
destination d_cisco { file(“/var/log/cisco/cisco.log”); };
log { source(s_net); destination(d_cisco); };

Quando tento executá-lo manualmente:

root@blackbox:~# /usr/sbin/syslog-ng -d

Running application hooks; hook='1'
Running application hooks; hook='3'
syslog-ng starting up; version='3.5.6'
Incoming log entry; line='<164>Feb 10 2016 15:03:59: %PIX-4-400037: IDS:6053 DNS all records request from 5.172.120.51 to 192.168.0.3 on interface outside\x0a'
Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d', error='No such file or directory (2)'
Incoming log entry; line='<164>Feb 10 2016 15:04:03: %PIX-4-400037: IDS:6053 DNS all records request from 5.172.120.51 to 192.168.0.3 on interface outside\x0a'
Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d', error='No such file or directory (2)'
Incoming log entry; line='<164>Feb 10 2016 15:04:07: %PIX-4-400037: IDS:6053 DNS all records request from 5.172.120.51 to 192.168.0.3 on interface outside\x0a'
Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d', error='No such file or directory (2)'
Incoming log entry; line='<164>Feb 10 2016 15:04:07: %PIX-4-400011: IDS:2001 ICMP unreachable from 198.48.92.104 to 192.168.0.3 on interface outside\x0a'
Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d', error='No such file or directory (2)'
Incoming log entry; line='<164>Feb 10 2016 15:04:07: %PIX-4-313005: No matching connection for ICMP error message: icmp src outside:198.48.92.104 dst inside:192.168.0.3 (type 3, code 3) on outside interface.  Original IP payload: udp src 192.168.0.3/53 dst 198.48.92.104/17106.\x0a'
Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d', error='No such file or directory (2)'
^Csyslog-ng shutting down; version='3.5.6'
Running application hooks; hook='4'

root@blackbox:~# cd /var/log/cisco/
root@blackbox:/var/log/cisco# ls -l
total 0
-rwxrw-rw- 1 root root 0 Feb 10 11:43 cisco.log
root@blackbox:/var/log/cisco#

    

Answer 1

O daemon Syslog-ng não estava inicializando corretamente aqui. Apesar de ter sido configurado para ser um servidor syslog remoto, a porta 514 / UDP também não estava aparecendo no netstat.

Depurando o problema com o comando:

/usr/sbin/syslog-ng -d

Vimos o erro:

Error opening file for writing; filename='\xe2\x80\x9c/var/log/cisco/cisco.log\xe2\x80\x9d'

Como \ xe2 \ x80 \ x9c são códigos de controle para códigos de caracteres UTF-8, chegamos à conclusão de que havia caracteres estranhos no arquivo de configuração syslog-ng.conf . Provavelmente, eles devem copiar e colar a configuração de uma página da Web, junto com um sistema que está sendo configurado com o UTF-8.

Editando com LANG = C para ter traduções de caracteres mínimas com o comando:

LANG=C vi /etc/syslog-ng/syslog-ng.conf

O usuário relatou a seguinte linha sem tradução UTF-8:

file(▒~@~\/var/log/cisco/cisco.log▒~@~]); 

A edição como deveria e a reinicialização corrigiu o problema:

file("/var/log/cisco/cisco.log");

De: UTF-8

UTF-8 is a character encoding capable of encoding all possible characters, or code points, in Unicode. The encoding is variable-length and uses 8-bit code units.

Por que “LANG = C”

In the C programming language, the locale name C “specifies the minimal environment for C translation”

Recomendação: tenha muito cuidado ao copiar & colando configurações diretamente das páginas da web. Nem todos os utilitários Unix entendem conjuntos de caracteres diferentes da representação ASCII tradicional.