I upgraded syslog-ng from an rpm from the Balabit website that I got sometime back. When I restarted the service I got the following error:

Error resolving user; user='root'
Error resolving group; group='root'

It then proceeds to restart. I do not get this error when I do stop/start. The config file seems to check out (I compared with a working system running a slightly older version (4.0.1)). /etc/passwd and group both have 'root' entries in them. My support account with Balabit has lapsed, which is why I'm asking about this here. Does anyone have any suggestions?

This syslog-ng PE 4.2.3, running on RHEL 5.6

This usually happens when you're using a name service switch config (see nsswitch.conf(5) for more info) that does not use /etc/passwd (like, if you're using ldap or something similar). The following in the shell should help determine if this is the problem:

By the way, if you extend you support contract with BalaBit, we can help you better and faster with any kind of question, or issue you may have!

Regards,
Gergely Nagy, on behalf of BalaBit support

We do have LDAP configured in the environment and those commands returned this:

[root@cde-dns1 ~]# getent passwd root
root:x:0:0:root:/root:/bin/bash
[root@cde-dns1 ~]# getent group root
root:x:0:root

Passwd, shadow and group, in nsswitch, are all set to: files ldap. And services are set to: files. Is there something in the syslog-ng.conf file that needs to be changed, since we are using LDAP?

Also, I have requested my access back to BOSS, but I don't know if my manager has contacted Balabit.