Syslog-ng constantly crashing

[KernelKat]

Once I disable "circular logging" syslog-ng is able to start and I am seeing log events now.

I dont know what the remifications of disabling that are? Can anyone shed light?

FWIW once disabling circular logging, syslogd now shows as being stopped.

What are your other settings looking like? I have mine disabled but syslog-ng still won't start. Ar you using anything else like IPS/IDS or other 3rd party or is this a vanillia install? Trying to figure out what is breaking mine.

[erickufrin]

Its holding steady right now since this morning.

I use a remote syslog server.... Most everything is pretty vanilla at the moment because I am battling a multi-wan issue and wanted to "start over".

[KernelKat]

Its holding steady right now since this morning.

I use a remote syslog server.... Most everything is pretty vanilla at the moment because I am battling a multi-wan issue and wanted to "start over".

I may just have to reinstall vanilla and go from there. shurg. idk what else to try and do at this point.

[gpb]

I may just have to reinstall vanilla and go from there. shurg. idk what else to try and do at this point.

Do you actually have a remote syslog server set up?  If so do you have anything being routed to it?  I have one running on an Rpi with one logging target for logged firewall rules.  Aside from that I too am mostly vanilla...I use NUT (UPS support), NTP server, Shaper, vnStat, and this shouldn't matter, but disabled all network acceleration (which should be default).

[KernelKat]

I may just have to reinstall vanilla and go from there. shurg. idk what else to try and do at this point.

Do you actually have a remote syslog server set up?  If so do you have anything being routed to it?  I have one running on an Rpi with one logging target for logged firewall rules.  Aside from that I too am mostly vanilla...I use NUT (UPS support), NTP server, Shaper, vnStat, and this shouldn't matter, but disabled all network acceleration (which should be default).

Yea, that I do. It's been getting all my logs from other devices before going to splunk so that aspect I know works. Think I might just go back to 20.1 or try rolling back some of my snapshots first see what results I get.

[CraigS]

Hi KernelKat,

Resetting the logfiles seemed to fix it.

I can now start syslog-ng again.

OPNSense 20.7

[mimugmail]

There is also a patch which comes with 20.7.1 tomorrow, maybe this will fix it

[gpb]

Hi KernelKat,

Resetting the logfiles seemed to fix it.

I can now start syslog-ng again.

OPNSense 20.7

That likely explains why I don't have the issue because I also did this (via command line deleted all log files) trying to debug the logging target issue in RC1 (fixed in 20.7).  Good find!

[Taomyn]

This is strange, I re-enabled circular logging in order to test if clearing the logs fixed the problem and it didn't. The syslogd service started and the syslog-ng one remained stopped - it was the other way around when circular logging was disabled.


I was then reading the text for the log file size and decided to increase it - I changed it to 10240 as I have the room, and after saving then once again clearing the logs now both syslogd and syslogd-ng are running.