Syslog-NG problems with ingesting syslog

Hello all,

As the title says I have a new setup with Syslog-NG and I'm running into some problems and can't determine how to best troubleshoot. At one point I had a couple test items all working and had not saved a backup config. During some editing of the config file I made too many adjustments and can't get it back to its previous state.

Syslog-NG does work at a local level, logs are regularly being recorded per the filter to the destination file. Where it is no longer working is ingesting syslog (udp/514). I have turned on verbose logging and even debug logging and attempted to determine where the error might be, however I'm not finding much detail or information.

Here's the configuration. I've tried multiple different types of filters (using host, subnet, with and without ", etc, destination changes, as well as source changes. Any advice or pointers would help greatly. Formatting has been mangled a bit when copying into reddit.

​

​

​

u/version : 3.24

# syslog-ng configuration file.

#

# This should behave pretty much like the original syslog on RedHat. But

# it could be configured a lot smarter.

#

# See syslog-ng(8) and syslog-ng.conf(5) for more information.

#

# Note: it also sources additional configuration files (*.conf)

# located in /etc/syslog-ng/conf.d/

​

options {

flush_lines (0);

time_reopen (10);

log_fifo_size (1000);

chain_hostnames (off);

use_dns (no);

use_fqdn (no);

create_dirs (yes);

keep_hostname (yes);

dns-cache (no);

};

​

source s_sys {

system();

internal();

};

​

source s_syslog {

syslog(transport("udp"));

};

​

destination d_cons { file("/dev/console"); };

destination d_mesg { file("/syslog/local/log/messages" perm(0640)); };

destination d_auth { file("/syslog/local/log/secure" perm(0640)); };

destination d_mail { file("/syslog/local/log/maillog" flush_lines(10) perm(0640)); };

destination d_spol { file("/syslog/local/log/spooler" perm(0640)); };

destination d_boot { file("/syslog/local/log/boot.log" perm(0640)); };

destination d_cron { file("/syslog/local/log/cron" perm(0640)); };

destination d_kern { file("/syslog/local/log/kern" perm(0640)); };

destination d_mlal { usertty("*"); };

destination paloalto { file("/syslog/network/paloalto/log_${HOST}" perm(0640)); };

destination switches { file("/syslog/network/switches/log_${HOST}" perm(0640)); };

​

filter f_kernel { facility(kern); };

filter f_default { level(info..emerg) and

not (facility(mail)

or facility(authpriv)

or facility(cron)); };

filter f_auth { facility(authpriv); };

filter f_mail { facility(mail); };

filter f_emergency { level(emerg); };

filter f_news { facility(uucp) or

(facility(news)

and level(crit..emerg)); };

filter f_boot { facility(local7); };

filter f_cron { facility(cron); };

filter syslog_switches { (netmask("10.0.0.8/30") or

(netmask("10.0.0.12/30"))); };

filter syslog_paloalto { host(10.0.0.20); };

​

​

log { source(s_sys); filter(f_kernel); destination(d_kern); };

log { source(s_sys); filter(f_default); destination(d_mesg); };

log { source(s_sys); filter(f_auth); destination(d_auth); };

log { source(s_sys); filter(f_mail); destination(d_mail); };

log { source(s_sys); filter(f_emergency); destination(d_mlal); };

log { source(s_sys); filter(f_news); destination(d_spol); };

log { source(s_sys); filter(f_boot); destination(d_boot); };

log { source(s_sys); filter(f_cron); destination(d_cron); };

log { source(s_syslog); filter(syslog_switches); destination(switches); };

log { source(s_syslog); filter(syslog_paloalto); destination(paloalto); };

​

# Source additional configuration files (.conf extension only)

u/include "/etc/syslog-ng/conf.d/*.conf"

​

# vim:ft=syslog-ng:ai:si:ts=4:sw=4:et: