If the 'error setting core limit to infinity; error='Operation not permitted' error pops up at syslog-ng service start.
If the system has gone through some CIS hardening which sets the 'DefaultLimitCORE in /etc/systemd/system.conf to 0' such error / issue can happen as the service has --enable-core in it:
ExecStart=/opt/syslog-ng/sbin/syslog-ng -F --enable-core $SYSLOGNG_OPTIONS
There is no issue with the --enable-core removal. However, it is possible that this switch must be re-added to the file for troubleshooting purposes in the future.
As per implementing, use the override.conf file instead of modify the original unit file (the override.conf file can be found on the /etc/system/syslog-ng.service.d path).
#systemctl edit syslog-ng.service
[Service]
ExecStart=
ExecStart=/opt/syslog-ng/sbin/syslog-ng -F $SYSLOGNG_OPTIONS
Once the editing has been done, run the following command:
#systemctl daemon-reload
© 2025 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center