-
Title
How to create a syslog-ng debug bundle on Linux Or Unix operating system. -
Description
This article contains the information necessary to capture a successful Debug Bundle (Archive) from within Syslog-ng PE.
When opening a new SR, it is imperative that a current, successfully created, debug bundle is included. A successfully created debug bundle will contain logs, data, and other pertinent information necessary to aid in diagnosing errors and/or issues within the Syslog-ng PE environment.
-
Cause
-
Resolution
Standard method of generating debug bundle
- Run the bundle generator script with the following options under the user runs syslog-ng.
/opt/syslog-ng/sbin/syslog-ng-debun -r
Warning!
If you get permission errors during the bundle generation, make sure that you're running it under the correct user. For example:
[2019-08-09T14:40:14.262891] Error opening configuration file; filename='/opt/syslog-ng/etc/syslog-ng.conf', error='Permission denied (13)'
Running the script under a non-privileged user (syslog-ng) without log in shell.
su -l syslogng -c '/opt/syslog-ng/sbin/syslog-ng-debun -r'
- Upload the collected debug bundle to the support ticket. The result can be found in your /tmp directory, under this kind of name: syslog.debun.${host}.${date}.${3-random-characters-or-pid}.tgz
- Internal logs of Syslog-ng can speed up and help the investigation.
Run the following command to collect them from the system log. Upload syslog-ng.log to the support ticket.
grep -i syslog-ng /var/log/messages > syslog-ng.log
Other options
These are some additional options that can be used without being asked by support engineers.
- To capture a Syslog-ng PE debug bundle without privacy-sensitive information run the following command:
/opt/syslog-ng/sbin/syslog-ng-debun -r -l
NOTE: The collected bundle may not include all the necessary information to solve an issue, therefore support engineers may ask for a standard debug bundle.
- To change the directory where the created debug bundle will be saved, use the following command:
/opt/syslog-ng/sbin/syslog-ng-debun -r -W "Directory"
Replace "Directory" with the location desired for the debug bundle to be saved.
Additional debug logs
- If supports requests a Syslog-ng PE debug bundle with syslog-ng startup debug logs included, first stop syslog-ng (i.e. systemctl stop syslog-ng), then use the following command:
/opt/syslog-ng/sbin/syslog-ng-debun -r -d
NOTE: Allow this command to run for 60-90 seconds, then press ENTER to exit. The syslog-ng process will automatically be restarted.
-
Attachments