[SOLVED] Syslog-ng and RHEL 7?

AWSmith · 09-02-2014, 03:23 PM

I've checked at balabit.com and their site indicates that its supported up to RHEL 6. I've got a shiny new RHEL7 server and I don't want to go back to 6 but it looks like its going to be necessary.

I've configured it and it loads, but it doesn't actually write anything to disk. running in debug mode in the foreground it acts as if its not receiving any input at all.

SELINUX disabled.

Not asking for help to get it configured but has anyone been able to do this?

AlucardZero · 09-02-2014, 05:36 PM

What syslog daemon does RHEL 7 come with? Can you use that? Are you going to post your config?

Smokey_justme · 09-02-2014, 05:43 PM

Doesn't RHEL 7 come with systemd and, thus, journald... I think you need to set journald to forward things somehow... but I might be wrong...

LE: Maybe take a look here and adjust to RHEL... https://wiki.archlinux.org/index.php/syslog-ng

czanik · 09-03-2014, 01:45 AM

If you use syslog-ng PE, then you have to wait for about a month until official support for RHEL 7 arrives.

If you use syslog-ng OSE, version 3.5.6 is available in the EPEL repository: https://fedoraproject.org/wiki/EPEL (obviously, without the PE features).

AWSmith · 09-03-2014, 07:54 AM

Many thanks to my sysadmin bretheren out there. I hope your day is filled with uptime and lots of Community Coffee (yes, a shameless plug, no I don't work for them...).

Ok, so I'm going to give it one last go with RHEL 7. I really wanted to compile and use it that way. i'm going To try out the link provided for Fedora.

I'll post a config once I finish.

AWSmith · 09-03-2014, 03:51 PM

Solved.

And I have to give some credit to everyone on the thread because they led me to different research paths to the answer.

The fix:

1. Download the latest (I used today's latest stable) version of syslog-ng.
2. Download the latest event program also from balabit.com.
3. Extract the event program, ./configure; make; make install - it worked well with a default program.
4. export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig (this presumes you have run ./configure with defaults on RHEL7).
5. Extract the syslog-ng program.
********* --- VIP --->6. ./configure --enable-linux-caps;make;make install
7. syslog-ng.conf: configure this with your stuff. Use the udp() driver for selecting network sourced data.
8. Turn off or configure the firewall which is on by default.
9. ? turn off SE Linux (I typically do this anyway) or configure it to allow the program.