How to create a syslog-ng debug bundle on Linux Or Unix operating system. (4291147)

This article contains the information necessary to capture a successful Debug Bundle (Archive) from within Syslog-ng PE.

When opening a new SR, it is imperative that a current, successfully created, debug bundle is included. A successfully created debug bundle will contain logs, data, and other pertinent information necessary to aid in diagnosing errors and/or issues within the Syslog-ng PE environment.

• Internal logs of Syslog-ng can speed up and help the investigation.
  Run the following command to collect them from the system log. Upload syslog-ng.log to the support ticket.

grep -i syslog-ng /var/log/messages > syslog-ng.log

Other options

These are some additional options that can be used without being asked by support engineers.

• To capture a Syslog-ng PE debug bundle without privacy-sensitive information run the following command:

/opt/syslog-ng/sbin/syslog-ng-debun -r -l

NOTE: The collected bundle may not include all the necessary information to solve an issue, therefore support engineers may ask for a standard debug bundle.

• To change the directory where the created debug bundle will be saved, use the following command:

/opt/syslog-ng/sbin/syslog-ng-debun -r -W "Directory"

Replace "Directory" with the location desired for the debug bundle to be saved.

Additional debug logs

• If supports requests a Syslog-ng PE debug bundle with syslog-ng startup debug logs included, first stop syslog-ng (i.e. systemctl stop syslog-ng), then use the following command:

/opt/syslog-ng/sbin/syslog-ng-debun -r -d

NOTE: Allow this command to run for 60-90 seconds, then press ENTER to exit. The syslog-ng process will automatically be restarted.