Is --enable-core option mandatory in syslog-ng? (4379524)

If the 'error setting core limit to infinity; error='Operation not permitted'  error pops up at syslog-ng service start.

If the system has gone through some CIS hardening which sets the 'DefaultLimitCORE in /etc/systemd/system.conf to 0' such error / issue can happen as the service has --enable-core in it:

ExecStart=/opt/syslog-ng/sbin/syslog-ng -F --enable-core $SYSLOGNG_OPTIONS 

There is no issue with the --enable-core removal. However, it is possible that this switch must be re-added to the file for troubleshooting purposes in the future.

As per implementing, use the override.conf file instead of modify the original unit file (the override.conf file can be found on the /etc/system/syslog-ng.service.d path).

#systemctl edit syslog-ng.service

[Service]
ExecStart=
ExecStart=/opt/syslog-ng/sbin/syslog-ng -F $SYSLOGNG_OPTIONS

Once the editing has been done, run the following command:

#systemctl daemon-reload