Messages

I may just have to reinstall vanilla and go from there. shurg. idk what else to try and do at this point.

Do you actually have a remote syslog server set up?  If so do you have anything being routed to it?  I have one running on an Rpi with one logging target for logged firewall rules.  Aside from that I too am mostly vanilla...I use NUT (UPS support), NTP server, Shaper, vnStat, and this shouldn't matter, but disabled all network acceleration (which should be default).

Yea, that I do. It's been getting all my logs from other devices before going to splunk so that aspect I know works. Think I might just go back to 20.1 or try rolling back some of my snapshots first see what results I get.

Its holding steady right now since this morning.

I use a remote syslog server.... Most everything is pretty vanilla at the moment because I am battling a multi-wan issue and wanted to "start over".

I may just have to reinstall vanilla and go from there. shurg. idk what else to try and do at this point.

Once I disable "circular logging" syslog-ng is able to start and I am seeing log events now.

I dont know what the remifications of disabling that are? Can anyone shed light?

FWIW once disabling circular logging, syslogd now shows as being stopped.

What are your other settings looking like? I have mine disabled but syslog-ng still won't start. Ar you using anything else like IPS/IDS or other 3rd party or is this a vanillia install? Trying to figure out what is breaking mine.

Keep posting those core dumps all maybe we will find some solutions :)

Has anyone tried removing syslog-ng and then reinstalling the same or different version? I'm not well versed in BSD so I'm still learning.

This afternoon I can't get syslog-ng to come back online to forward to splunk. I've tried disabling syslog, upgrading to the latest version. Any other ideas? All I am seeing is core dumps.

I'm seeing the same thing.  I can't seem to start the syslog-ng service.  This is what I see in the logs when I try to start the service:
kernel: pid 78934 (syslog-ng), jid 0, uid 0: exited on signal 11 (core dumped)


I have a core file for this attempt to start syslog-ng.  Let me know if there is someplace I should upload it.

You can  upload to any online fil host site and then post link here ;)

Can you Upload them somewhere?

Uploaded!

Not 100% sure but I have a syslog-ng.core file in /usr/.  Guessing that's it.

Found it. /var/db

https://filebin.net/ew8rz8m7gxkdcf4s

How do I pull the core dumps? I feel so stupid I didn't even think about that.

This afternoon I can't get syslog-ng to come back online to forward to splunk. I've tried disabling syslog, upgrading to the latest version. Any other ideas? All I am seeing is core dumps.