syslog-ng fails to start on reboot

SUSE Product Topics SLES Configure-Administer
1

We are setting up a syslog server for 3rd party appliances to send logs to but for some reason the default install of syslog-ng will not start up on a reboot of the server. Once I login I can start it with no problem.

Here is the errors on the reboot when I run a ‘status’

systemctl status syslog-ng

● syslog-ng.service - System Logging Service
Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Mon 2018-09-17 13:25:30 EDT; 2min 26s ago
Process: 1089 ExecStart=/usr/sbin/syslog-ng -F $SYSLOG_NG_PARAMS (code=exited, status=2)
Process: 1084 ExecStartPre=/usr/sbin/syslog-ng-service-prepare (code=exited, status=0/SUCCESS)
Main PID: 1089 (code=exited, status=2)

Sep 17 13:25:30 rogue514 systemd[1]: Starting System Logging Service…
Sep 17 13:25:30 rogue514 systemd[1]: Started System Logging Service.
Sep 17 13:25:30 rogue514 systemd[1]: syslog-ng.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
Sep 17 13:25:30 rogue514 systemd[1]: syslog-ng.service: Unit entered failed state.
Sep 17 13:25:30 rogue514 systemd[1]: syslog-ng.service: Failed with result ‘exit-code’.
Sep 17 13:25:30 rogue514 systemd[1]: syslog-ng.service: Start request repeated too quickly.
Sep 17 13:25:30 rogue514 systemd[1]: Failed to start System Logging Service.
Sep 17 13:25:30 rogue514 systemd[1]: syslog-ng.service: Failed with result ‘start-limit’.

I tried adding network.target to the “After=” in the syslog-ng.service file but that just caused other errors. Any ideas ?

thanks

2

Hi,

for some reason the default install of syslog-ng will not start up on a reboot of the server

Sep 17 13:25:30 rogue514 systemd[1]: syslog-ng.service: Main process exited, code=exited, status=2/INVALIDARGUMENT

so syslog-ng gets started, but fails. Have you changed anything in its configuration that might cause the failure during the early start (“early” because, as you describe, a start at a later time will work)? Probably also worth a look might be the journal messages surrounding the start of the syslog-ng daemon.

I haven’t used syslog-ng in ages, so definitely not with SLES12SP3 - it might be worth a try to switch to rsyslog.

Regards,
J