Syslog-ng 3.5.6 error

[elisiano]

Hi, first of all thanks for this module. I'm pretty new at this so I might be overlooking something obvious.

So I compiled syslog-ng 3.5.6 for CentOS 6, I enabled all the log paths. On the server, the daemon starts without any issues, but on the other hand, the client fails with the following message:

Error resolving reference; content='filter', name='f_puppet-agent', location='/etc/syslog-ng/syslog-ng.conf.d/log.d/00_syslog_puppet-agent-a.conf:3:22'

And here's the generated config file:

[root@test01 syslog-ng]# cat /etc/syslog-ng/syslog-ng.conf.d/log.d/00_syslog_puppet-agent-a.conf
# Remote log for puppet-agent

log { source(s_log); filter(f_puppet-agent); destination(d_syslog_<my_remote_host>); };

Checking the config, f_puppet_agent is defined:

[root@test01 syslog-ng]# cat /etc/syslog-ng/syslog-ng.conf.d/filter.d/puppet-agent.conf 
# puppet-agent filter

filter f_puppet_agent { program("puppet-agent"); };

Am I doing something obviously wrong?

This is how the class is declared on the client ( $syslog_remote_host contains the remote server):

    class { '::syslogng':
      ensure         => present,
      purge_conf_dir => true,
      logpaths       => {
        'acpid'          => { } ,
        'amavis'         => { } ,
        'anacron'        => { } ,
        'atftpd'         => { } ,
        'authdaemond'    => { } ,
        'bluetoothd'     => { } ,
        'clamd'          => { } ,
        'crond'          => { } ,
        'dbus'           => { } ,
        'dhclient'       => { } ,
        'dhcpcd'         => { } ,
        'dhcpd'          => { } ,
        'dovecot'        => { } ,
        'fc-brokerd'     => { } ,
        'freshclam'      => { } ,
        'haveged'        => { } ,
        'imapd'          => { } ,
        'laptop-mode'    => { } ,
        'libvirtd'       => { } ,
        'libvirt-hook'   => { } ,
        'lightdm'        => { } ,
        'mod_php'        => { } ,
        'msmtp'          => { } ,
        'NetworkManager' => { } ,
        'nslcd'          => { } ,
        'ntpd'           => { } ,
        'pdns'           => { } ,
        'pdns_recursor'  => { } ,
        'polkitd'        => { } ,
        'pop3d'          => { } ,
        'portage'        => { } ,
        'postfix'        => { } ,
        'postgres'       => { } ,
        'provisioning'   => { } ,
        'puppet-agent'   => { } ,
        'puppet-master'  => { } ,
        'pure-ftpd'      => { } ,
        'racoon'         => { } ,
        'radiusd'        => { } ,
        'rsnapshot'      => { } ,
        'saslauthd'      => { } ,
        'slapd'          => { } ,
        'snmptrapd'      => { } ,
        'smartd'         => { } ,
        'sshd'           => { } ,
        'ssmtp'          => { } ,
        'sst-firewall'   => { } ,
        'stunnel'        => { } ,
        'sudo'           => { } ,
        'SuSEfirewall2'  => { } ,
        'syslog-ng'      => { } ,
        'tor'            => { } ,
        'ucarp'          => { } ,
        'ucarp-hook'     => { } ,
        'ulogd'          => { } ,
        'uwsgi'          => { } ,
        'vm-manager'     => { } ,
        'yum'            => { } ,
        'zabbix-agentd'  => { } ,
        'zabbix-proxy'   => { }
      },
      destinations => {
        "${syslog_remote_host}" => {
          type               => 'syslog',
          logpaths           => {
            'acpid-a'          => { logpath => 'acpid' } ,
            'amavis-a'         => { logpath => 'amavis' } ,
            'anacron-a'        => { logpath => 'anacron' } ,
            'atftpd-a'         => { logpath => 'atftpd' } ,
            'authdaemond-a'    => { logpath => 'authdaemond' } ,
            'bluetoothd-a'     => { logpath => 'bluetoothd' } ,
            'clamd-a'          => { logpath => 'clamd' } ,
            'crond-a'          => { logpath => 'crond' } ,
            'dbus-a'           => { logpath => 'dbus' } ,
            'dhclient-a'       => { logpath => 'dhclient' } ,
            'dhcpcd-a'         => { logpath => 'dhcpcd' } ,
            'dhcpd-a'          => { logpath => 'dhcpd' } ,
            'dovecot-a'        => { logpath => 'dovecot' } ,
            'fc-brokerd-a'     => { logpath => 'fc-brokerd' } ,
            'freshclam-a'      => { logpath => 'freshclam' } ,
            'haveged-a'        => { logpath => 'haveged' } ,
            'imapd-a'          => { logpath => 'imapd' } ,
            'laptop-mode-a'    => { logpath => 'laptop-mode' } ,
            'libvirtd-a'       => { logpath => 'libvirtd' } ,
            'libvirt-hook-a'   => { logpath => 'libvirt-hook' } ,
            'lightdm-a'        => { logpath => 'lightdm' } ,
            'mod_php-a'        => { logpath => 'mod_php' } ,
            'msmtp-a'          => { logpath => 'msmtp' } ,
            'NetworkManager-a' => { logpath => 'NetworkManager' } ,
            'nslcd-a'          => { logpath => 'nslcd' } ,
            'ntpd-a'           => { logpath => 'ntpd' } ,
            'pdns-a'           => { logpath => 'pdns' } ,
            'pdns_recursor-a'  => { logpath => 'pdns_recursor' } ,
            'polkitd-a'        => { logpath => 'polkitd' } ,
            'pop3d-a'          => { logpath => 'pop3d' } ,
            'portage-a'        => { logpath => 'portage' } ,
            'postfix-a'        => { logpath => 'postfix' } ,
            'postgres-a'       => { logpath => 'postgres' } ,
            'provisioning-a'   => { logpath => 'provisioning' } ,
            'puppet-agent-a'   => { logpath => 'puppet-agent' } ,
            'puppet-master-a'  => { logpath => 'puppet-master' } ,
            'pure-ftpd-a'      => { logpath => 'pure-ftpd' } ,
            'racoon-a'         => { logpath => 'racoon' } ,
            'radiusd-a'        => { logpath => 'radiusd' } ,
            'rsnapshot-a'      => { logpath => 'rsnapshot' } ,
            'saslauthd-a'      => { logpath => 'saslauthd' } ,
            'slapd-a'          => { logpath => 'slapd' } ,
            'snmptrapd-a'      => { logpath => 'snmptrapd' } ,
            'smartd-a'         => { logpath => 'smartd' } ,
            'sshd-a'           => { logpath => 'sshd' } ,
            'ssmtp-a'          => { logpath => 'ssmtp' } ,
            'sst-firewall-a'   => { logpath => 'sst-firewall' } ,
            'stunnel-a'        => { logpath => 'stunnel' } ,
            'sudo-a'           => { logpath => 'sudo' } ,
            'SuSEfirewall2-a'  => { logpath => 'SuSEfirewall2' } ,
            'syslog-ng-a'      => { logpath => 'syslog-ng' } ,
            'tor-a'            => { logpath => 'tor' } ,
            'ucarp-a'          => { logpath => 'ucarp' } ,
            'ucarp-hook-a'     => { logpath => 'ucarp-hook' } ,
            'ulogd-a'          => { logpath => 'ulogd' } ,
            'uwsgi-a'          => { logpath => 'uwsgi' } ,
            'vm-manager-a'     => { logpath => 'vm-manager' } ,
            'yum-a'            => { logpath => 'yum' } ,
            'zabbix-agentd-a'  => { logpath => 'zabbix-agentd' } ,
            'zabbix-proxy-a'   => { logpath => 'zabbix-proxy' }
            } # logpaths
        } # ${syslog_remote_host}
      } # destinations
    } # class

[hairmare]

You don't seem to be doing anything obviously wrong. For some reason the remote log config is referencing f_puppet-agent with a dash rather than using an underscore as defined in the filter config.

As far as I can tell it should work if you define the puppet-agent-a logpath as follows.

'puppet-agent-a'   => { logpath => 'puppet_agent' } ,

[elisiano]

Thanks @hairmare, that fixed that specific case and the same hint applied for other 3 log paths.

            'puppet-agent-a'   => { logpath => 'puppet_agent' } ,  
            'puppet-master-a'  => { logpath => 'puppet_master' } , 
            [...]
            'ulogd-a'          => { logpath => 'netfilter' } , 
            'uwsgi-a'          => { logpath => 'uwsgi-common' } ,

Just as a remark, once the log paths were fixed, this errore came up:

Execution of '/sbin/service syslog-ng start' returned 1: Starting syslog-ng: Error resolving reference; content='destination', name='d_messages', location='/etc/syslo
g-ng/syslog-ng.conf.d/log.d/99_catch-all.conf:2:40'

I just needed to explicitly add the messages destination along of the remote one:

        "messages" => {},

is that the intended behavior?

Now I just need to figure out why the remote is not listening for incoming network messages, but since it's a separate issue, I'm gonna report it separately.

Thanks again for your help.

[elisiano]

So never mind my previous question about destinations, the defaults (messages, console, kernel) are overwritten by the remotes so they need to be specifically added.

Thanks for your help.