[BUG] Error parsing config when using MQTT

Open
#26 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
38/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
docker

Research direction

Start by reproducing the error with the supplied /config/syslog-ng.conf and the MQTT destination on the documented Docker image and arm64 environment. Compare the reported parser location with the syslog-ng MQTT destination documentation. Done means the container starts without a parsing error and messages matching the DHCP filter are delivered to MQTT.

Written by the indexing model from the issue text.

Description

work-in-progress
Is there an existing issue for this?
  • I have searched the existing issues
Current Behavior

Attempting to set up an MQTT destination results in an error parsing config. I originally thought it was related to this issue, but I was able to eliminate the cloud_auth error by rolling back to version 4.1.1-r2-ls99 with no change to the MQTT error.

This is a new setup of syslog-ng, and I'm using the official documentation to set up a very basic log source & destination.

Expected Behavior

syslog-ng should start without an error parsing, and should log to an MQTT destination.

Steps To Reproduce

Set up syslog-ng with a basic configuration, and attempt to add an MQTT destination. Syslog-ng will then fail to start and will log a parsing error.

Environment
- OS: Raspbian
- How docker service was installed: sudo apt-get install docker-compose

syslog-ng.conf:

#############################################################################
# Default syslog-ng.conf file which collects all local logs into a
# single file called /var/log/messages tailored to container usage.

@version: 4.1
@include "scl.conf"

source s_local {
  internal();
};

source s_network_tcp {
  syslog(transport(tcp) port(6601));
};

source s_network_udp {
  syslog(transport(udp) port(5514));
};

destination d_local {
  file("/var/log/messages");
  file("/var/log/messages-kv.log" template("$ISODATE $HOST $(format-welf --scope all-nv-pairs)\n") frac-digits(3));
};

destination d_mqtt {
  mqtt(topic("router/dhcp/eth1"), address("tcp://myhost:1883"), username("myuser"), password("mypassword"));
};

log {
  source(s_local);
  source(s_network_tcp);
  source(s_network_udp);
  parser(panos-parser());
  destination(d_local);
  if (message("DHCP"))
  {
    destination(d_mqtt);
  };
};


### CPU architecture

arm64

### Docker creation

```bash
---
services:
  syslog-ng:
    image: lscr.io/linuxserver/syslog-ng:4.1.1-r2-ls99
    container_name: syslog-ng
    environment:
      - PUID=1000
      - PGID=1000
      - TZ='America/New_York'
    volumes:
      - /home/steve/docker/syslog-ng/config:/config
      - /home/steve/docker/syslog-ng/log:/var/log
    ports:
      - 514:5514/udp
      - 601:6601/tcp
      - 6514:6514/tcp
    restart: unless-stopped
Container logs
Logs from `docker logs syslog-ng`:

[migrations] started
[migrations] no migrations found
usermod: no changes
───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    1000
User GID:    1000
───────────────────────────────────────

[custom-init] No custom files found, skipping...
[ls.io-init] done.

Logs from syslog-ng itself (config/log/current):

2024-06-02 18:16:55.699826612  Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /config/syslog-ng.conf:26:3-26:7:
2024-06-02 18:16:55.699999128  21        file("/var/log/messages");
2024-06-02 18:16:55.700063794  22        file("/var/log/messages-kv.log" template("$ISODATE $HOST $(format-welf --scope all-nv-pairs)\n") frac-digits(3));
2024-06-02 18:16:55.700070035  23      };
2024-06-02 18:16:55.700073868  24
2024-06-02 18:16:55.700078387  25      destination d_mqtt {
2024-06-02 18:16:55.700140627  26---->   mqtt(topic("router/dhcp/eth1"), address("tcp://myhost:1883"), username("myuser"), password("mypassword"));
2024-06-02 18:16:55.700198459  26---->   ^^^^
2024-06-02 18:16:55.700204126  27      };
2024-06-02 18:16:55.700207552  28
2024-06-02 18:16:55.700211107  29      log {
2024-06-02 18:16:55.700215200  30        source(s_local);
2024-06-02 18:16:55.700271329  31        source(s_network_tcp);
2024-06-02 18:16:55.700445938
2024-06-02 18:16:55.700452012
2024-06-02 18:16:55.700459827  syslog-ng documentation: https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition
2024-06-02 18:16:55.700463364  contact:
2024-06-02 18:16:55.700468789   GitHub Project: https://github.com/syslog-ng/syslog-ng
2024-06-02 18:16:55.700474604   Chat with the Developers: https://gitter.im/syslog-ng/syslog-ng
2024-06-02 18:16:55.700480363   Mailing List: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Dominant language
Dockerfile
Stars
86
Forks
9
PR merge metrics
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from linuxserver/docker-syslog-ng

All issues in linuxserver/docker-syslog-ng

Similar issues

More Observability & SRE issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.