Return
-
Title
udp-balancer() Source Not Working When Using Non-Root Account -
Description
The udp-balancer() source is not working when running Syslog-ng with an account other than the root account.
The following error is found in the logs: Error loading BPF program -
Cause
The service account being used to run Syslog-ng does not have the correct capabilities to access the eBPF (Extended Berkeley Packet Filter) plugin in the Linux kernel which is required to use the udp-balancer() source within Syslog-ng. -
Resolution
Please add the following capabilities to the service account's ambient capabilities:SYS_ADMIN (CAP_SYS_ADMIN)
Once done the service account running Syslog-ng PE should have access to the eBPF plugin and the udp-balancer() should work.