6

If anyone has got syslog-ng working on Solaris 10, do you have a set of instructions I could follow to get it installed and working?

I tried following this http://opensystems.wordpress.com/2006/06/01/replacing-syslog-on-solaris-10-with-syslog-ng/ but got stuck with the syslog-ng service stuck restarting with no indication of why.

Thanks for any help. NickB

NickB
  • 273
  • 3
  • 6
  • Can you post the result of svcs -x ? – Antoine Benkemoun Jan 26 '10 at 10:12
  • NDBCA2:/var/adm# svcs -x svc:/site/system-log-ng:default (system log ng) State: maintenance since Tue Jan 26 09:38:44 2010 Reason: Restarting too quickly. See: http://sun.com/msg/SMF-8000-L5 See: syslog-ng(1M) See: /var/svc/log/site-system-log-ng:default.log Impact: This service is not running. NDBCA2:/var/adm# – NickB Jan 26 '10 at 10:15
  • Maybe a problem with the /usr/local/etc/syslog-ng/syslog-ng.conf file? permissions look OK - root:root and -rw-r--r-- – NickB Jan 26 '10 at 10:17
  • And the linked log file has this (repeated) syslog service starting. [ Jan 26 09:38:44 Method "start" exited with status 0 ] [ Jan 26 09:38:44 Stopping because all processes in service exited. ] [ Jan 26 09:38:44 Executing stop method (:kill) ] [ Jan 26 09:38:44 Restarting too quickly, changing state to maintenance ] – NickB Jan 26 '10 at 10:18
  • 1
    Have you tried starting things up manually, in the same way that is being done by SMF? You might get some error message clues as to why syslog-ng is exiting. – Tekhne Jun 17 '10 at 21:09

2 Answers2

4

I do not like the instructions on the opensystems blog you pointed to, as it replaces the default service in SMF. This is bad as it is likely that a future system patch will revert your changes. Here's my take on it, from a default system state:

  1. Disable the system syslog:
    svcadm disable system-log
  2. Download and install (using pkgadd) syslog-ng from sunfreeware.com
    http:// sunfreeware.com/programlistintel10.html#syslogng
    Do not forget to also download and install its dependencies.
  3. Create a configuration file /usr/local/etc/syslog-ng.conf (the one offered on the Open Systems blog is a good start).
  4. Setup the SMF voodoo:
    • Create /var/svc/manifest/site/syslog-ng.xml from http://pastebin.com/QrGC3u6p (I could not paste the file here as the formatting was mangled)
    • Load the new service: svccfg import /var/svc/manifest/site/syslog-ng.xml
    • Enable the service: svcadm enable syslog-ng

Now, your system is not vanilla if you followed the procedure on Open Systems blog. Here's what you need to do to revert:

  1. Disable the modified SMF service:
    • svcadm disable system-log-ng
    • svccfg delete system-log-ng
  2. Remove the syslopg-ng package
    • pkgrm NCsysng
  3. Re-import the original system log service:
    • svccfg import /var/svc/manifest/system/system-log.xml
    • svcadm enable system-log

Hope this helps.

Urgoll
  • 681
  • 3
  • 6
0

https://lists.balabit.hu/pipermail/syslog-ng/2005-June/007531.html

http://www.swissunixsupport.com/syslog-ngsoalris10

should help you out.

M_1
  • 363
  • 2
  • 10