The default configuration of app-admin/syslog-ng does not contain the @include "scl.conf" line, even though scl.conf, and modules.conf are installed nevertheless.
This is confusing, as users end up editing modules.conf, and enabling non-default modules there (eg, the mongodb destination), yet, that will have no effect, as these files are not loaded by the default config.
It would be very nice if this could be fixed, either by adding an @include "scl.conf" to the default configs (which will also make the system() source available), or not installing the scl.conf and modules.conf files.
In either case, when non-default plugins are enabled, if the ebuild could elog a notice that special configuration may be needed, such as adding the appropriate load statement to the configuration, that would be even more awesome.
fixed in 3.4.1
I'm getting an error after update:
# /etc/init.d/syslog-ng restart
* Stopping syslog-ng ... [ ok ]
* Checking your configfile (/etc/syslog-ng/syslog-ng.conf) ...
Error parsing block argument, syntax error, unexpected $end, expecting LL_BLOCK in /usr/share/include/scl/pacct/plugin.conf at line 27, column 1:
included from /etc/syslog-ng/scl.conf line 33, column 1
included from /etc/syslog-ng/syslog-ng.conf line 8, column 1
syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng
* Configuration error. Please fix your configfile (/etc/syslog-ng/syslog-ng.conf) [ !! ]
* ERROR: syslog-ng failed to start
For some reason, the /usr/share/include/scl/pacct/plugin.conf is not valid. There's, however, a workaround: just comment line 32 in /etc/syslog-ng/scl.conf (the line including errorish file).
This should be fixed in 3.4.3, I believe. Please let me know if it still happens with that version.
Oh, sorry. I forgot to mention that this is with the 3.4.3 release. However, there are some other issues with it - for which I've opened a separate bug 484564.
Hm, interesting. Is the pacct module compiled? (I'll try it in a clean environment later)
It is not:
syslog-ng Open Source Edition 3.4.3 configured
Module search path : /usr/lib64/syslog-ng
Sun STREAMS support (module): no
SSL support (module) : yes
SQL support (module) : no
PACCT module (EXPERIMENTAL) : no
MongoDB destination (module): no
On the other hand, the ebuild doesn't enable it explicitly. And the confugure.ac don't enable PACCT if not explicitly asked on the command line. So either ebuild must pass --enable-pacct or the syslog-ng should make the 'include' line mentioned in comment 2 conditional based on PACCT enabled or not.
Aagrh. Found the problem and resolved it. It was a bug introduced as a fix by, ehm, me when I tried fix to bug 484564. So consider this as false alarm.
Actually this bug should be called "should not include" because
@define include-path "`include-path`:`syslog-ng-data`/include"
at least I cannot found the `syslog-ng-data` statement, neither in the config files, nor in the syslog-ng documentation. So it's unclear what this path is, though it can be guessed.
In my point of view this is a bug and should not happen. Either document that path or build a tool that shows this path.