Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Errors when starting SC4S service in a bare metal deployment #2702

Open
yoann-ls opened this issue Feb 12, 2025 · 2 comments · May be fixed by #2703
Open

Errors when starting SC4S service in a bare metal deployment #2702

yoann-ls opened this issue Feb 12, 2025 · 2 comments · May be fixed by #2703
Assignees
@ikheifets-splunk
Labels
Environment Issue and bug related to environment

Comments

@yoann-ls
Copy link

Was the issue replicated by support?
Bare metal installation on Ubuntu 22.04.4 LTS fails to start SC4S service with errors

What is the sc4s version ?
3.34.2 bare metal

Which operating system (including its version) are you using for hosting SC4S?
Ubuntu 22.04.4 LTS

Which runtime (Docker, Podman, Docker Swarm, BYOE, MicroK8s) are you using for SC4S?
BYOE

Is there a pcap available? If so, would you prefer to attach it to this issue or send it to Splunk support?
N/A

Is the issue related to the environment of the customer or Software related issue?
Software

Describe the bug
Service SC4S fails to start

To Reproduce
Steps to reproduce the behavior:

  1. Ubuntu 22.04.4 LTS
  2. Install syslog-ng 4.8
  3. Instal dependencies
  4. Start service sc4s

Feb 12 14:07:26 ip-10-202-38-180 entrypoint.sh[2638]: python3: can't open file '/source_ports_validator.py': [Errno 2] No such file or directory
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/conf.d/conflib/_common/p_compliance_meta.conf:2:5-2:24:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 1 parser compliance_meta_by_source {
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 2-----> add-contextual-data(
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 2-----> ^^^^^^^^^^^^^^^^^^^
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 3 selector(filters("syslog-ng-sysconfdir/conf.d/local/context/compliance_meta_by_source.conf")),
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 4 database("syslog-ng-sysconfdir/conf.d/local/context/compliance_meta_by_source.csv")
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 5 ignore-case(yes)
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 6 );
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 7 };
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: Included from /etc/syslog-ng/syslog-ng.conf:32:1-32:1:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 27 # Order is important; templates must be loaded first
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 28 # ===============================================================================================
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 29 @include "conf.d/templates/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 30 @include "conf.d/conflib/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 31 @include "conf.d/conflib//.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 32----> @include "conf.d/local/config/app_parsers/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 32----> ^
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 33 @include "conf.d/local/config/app_parsers//.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 34
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 35 @include "conf.d/filters//.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 36 @include "conf.d/local/config/filters/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 37
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: syslog-ng documentation: https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: contact:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: GitHub Project: https://github.com/syslog-ng/syslog-ng
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: Chat with the Developers: https://gitter.im/syslog-ng/syslog-ng
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: Mailing List: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/conf.d/conflib/_common/p_compliance_meta.conf:2:5-2:24:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 1 parser compliance_meta_by_source {
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 2-----> add-contextual-data(
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 2-----> ^^^^^^^^^^^^^^^^^^^
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 3 selector(filters("syslog-ng-sysconfdir/conf.d/local/context/compliance_meta_by_source.conf")),
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 4 database("syslog-ng-sysconfdir/conf.d/local/context/compliance_meta_by_source.csv")
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 5 ignore-case(yes)
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 6 );
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 7 };
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: Included from /etc/syslog-ng/syslog-ng.conf:32:1-32:1:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 27 # Order is important; templates must be loaded first
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 28 # ===============================================================================================
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 29 @include "conf.d/templates/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 30 @include "conf.d/conflib/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 31 @include "conf.d/conflib//.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 32----> @include "conf.d/local/config/app_parsers/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 32----> ^
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 33 @include "conf.d/local/config/app_parsers//.conf"
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit sc4s.service has finished successfully.
░░
░░ The job identifier is 2336.
Feb 12 14:07:21 ip-10-202-38-180 entrypoint.sh[2570]: SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful to index=main for sourcetype=sc4s:fallback...
Feb 12 14:07:26 ip-10-202-38-180 entrypoint.sh[2614]: {"text":"Server is busy","code":9,"invalid-event-number":0}
Feb 12 14:07:26 ip-10-202-38-180 entrypoint.sh[2570]: SC4S_ENV_CHECK_HEC: Invalid Splunk HEC URL, invalid token, or other HEC connectivity issue for index=main. sourcetype=sc4s:events
Feb 12 14:07:26 ip-10-202-38-180 entrypoint.sh[2570]: Startup will continue to prevent data loss if this is a transient failure.
Feb 12 14:07:26 ip-10-202-38-180 entrypoint.sh[2638]: python3: can't open file '/source_ports_validator.py': [Errno 2] No such file or directory
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/conf.d/conflib/_common/p_compliance_meta.conf:2:5-2:24:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 1 parser compliance_meta_by_source {
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 2-----> add-contextual-data(
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 2-----> ^^^^^^^^^^^^^^^^^^^
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 3 selector(filters("syslog-ng-sysconfdir/conf.d/local/context/compliance_meta_by_source.conf")),
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 4 database("syslog-ng-sysconfdir/conf.d/local/context/compliance_meta_by_source.csv")
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 5 ignore-case(yes)
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 6 );
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 7 };
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: Included from /etc/syslog-ng/syslog-ng.conf:32:1-32:1:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 27 # Order is important; templates must be loaded first
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 28 # ===============================================================================================
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 29 @include "conf.d/templates/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 30 @include "conf.d/conflib/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 31 @include "conf.d/conflib//.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 32----> @include "conf.d/local/config/app_parsers/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 32----> ^
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 33 @include "conf.d/local/config/app_parsers//.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 34
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 35 @include "conf.d/filters//.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 36 @include "conf.d/local/config/filters/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 37
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: syslog-ng documentation: https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: contact:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: GitHub Project: https://github.com/syslog-ng/syslog-ng
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: Chat with the Developers: https://gitter.im/syslog-ng/syslog-ng
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: Mailing List: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/conf.d/conflib/_common/p_compliance_meta.conf:2:5-2:24:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 1 parser compliance_meta_by_source {
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 2-----> add-contextual-data(
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 2-----> ^^^^^^^^^^^^^^^^^^^
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 3 selector(filters("syslog-ng-sysconfdir/conf.d/local/context/compliance_meta_by_source.conf")),
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 4 database("syslog-ng-sysconfdir/conf.d/local/context/compliance_meta_by_source.csv")
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 5 ignore-case(yes)
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 6 );
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 7 };
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: Included from /etc/syslog-ng/syslog-ng.conf:32:1-32:1:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 27 # Order is important; templates must be loaded first
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 28 # ===============================================================================================
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 29 @include "conf.d/templates/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 30 @include "conf.d/conflib/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 31 @include "conf.d/conflib//.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 32----> @include "conf.d/local/config/app_parsers/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 32----> ^
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 33 @include "conf.d/local/config/app_parsers//.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 34
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 35 @include "conf.d/filters//.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 36 @include "conf.d/local/config/filters/.conf"
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: 37
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: syslog-ng documentation: https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: contact:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: GitHub Project: https://github.com/syslog-ng/syslog-ng
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: Chat with the Developers: https://gitter.im/syslog-ng/syslog-ng
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2655]: Mailing List: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2570]: syslog-ng checking config
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2570]: sc4s version=3.34.2
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2570]: Configuring the health check port to: 8080
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2680]: [2025-02-12 14:07:28 +0000] [2680] [INFO] Starting gunicorn 23.0.0
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2680]: [2025-02-12 14:07:28 +0000] [2680] [INFO] Listening at: http://0.0.0.0:8080 (2680)
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2680]: [2025-02-12 14:07:28 +0000] [2680] [INFO] Using worker: sync
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: [2025-02-12 14:07:28 +0000] [2684] [INFO] Booting worker with pid: 2684
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: [2025-02-12 14:07:28 +0000] [2684] [ERROR] Exception in worker process
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: Traceback (most recent call last):
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: File "/var/lib/python-venv/lib/python3.10/site-packages/gunicorn/arbiter.py", line 608, in spawn_worker
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: worker.init_process()
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: File "/var/lib/python-venv/lib/python3.10/site-packages/gunicorn/workers/base.py", line 135, in init_process
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: self.load_wsgi()
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: File "/var/lib/python-venv/lib/python3.10/site-packages/gunicorn/workers/base.py", line 147, in load_wsgi
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: self.wsgi = self.app.wsgi()
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: File "/var/lib/python-venv/lib/python3.10/site-packages/gunicorn/app/base.py", line 66, in wsgi
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: self.callable = self.load()
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: File "/var/lib/python-venv/lib/python3.10/site-packages/gunicorn/app/wsgiapp.py", line 57, in load
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: return self.load_wsgiapp()
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: File "/var/lib/python-venv/lib/python3.10/site-packages/gunicorn/app/wsgiapp.py", line 47, in load_wsgiapp
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: return util.import_app(self.app_uri)
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: File "/var/lib/python-venv/lib/python3.10/site-packages/gunicorn/util.py", line 370, in import_app
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: mod = importlib.import_module(module)
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: File "/usr/lib/python3.10/importlib/init.py", line 126, in import_module
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: return _bootstrap._gcd_import(name[level:], package, level)
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: File "", line 1050, in _gcd_import
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: File "", line 1027, in _find_and_load
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: File "", line 1004, in _find_and_load_unlocked
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: ModuleNotFoundError: No module named 'healthcheck'
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2684]: [2025-02-12 14:07:28 +0000] [2684] [INFO] Worker exiting (pid: 2684)
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2680]: [2025-02-12 14:07:28 +0000] [2680] [ERROR] Worker (pid:2684) exited with code 3
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2680]: [2025-02-12 14:07:28 +0000] [2680] [ERROR] Shutting down: Master
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2680]: [2025-02-12 14:07:28 +0000] [2680] [ERROR] Reason: Worker failed to boot.
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/conf.d/conflib/_common/p_compliance_meta.conf:2:5-2:24:
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 1 parser compliance_meta_by_source {
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 2-----> add-contextual-data(
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 2-----> ^^^^^^^^^^^^^^^^^^^
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 3 selector(filters("syslog-ng-sysconfdir/conf.d/local/context/compliance_meta_by_source.conf")),
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 4 database("syslog-ng-sysconfdir/conf.d/local/context/compliance_meta_by_source.csv")
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 5 ignore-case(yes)
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 6 );
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 7 };
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: Included from /etc/syslog-ng/syslog-ng.conf:32:1-32:1:
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 27 # Order is important; templates must be loaded first
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 28 # ===============================================================================================
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 29 @include "conf.d/templates/.conf"
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 30 @include "conf.d/conflib/.conf"
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 31 @include "conf.d/conflib//.conf"
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 32----> @include "conf.d/local/config/app_parsers/.conf"
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 32----> ^
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 33 @include "conf.d/local/config/app_parsers//.conf"
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 34
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 35 @include "conf.d/filters//.conf"
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 36 @include "conf.d/local/config/filters/*.conf"
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: 37
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: syslog-ng documentation: https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: contact:
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: GitHub Project: https://github.com/syslog-ng/syslog-ng
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: Chat with the Developers: https://gitter.im/syslog-ng/syslog-ng
Feb 12 14:07:28 ip-10-202-38-180 entrypoint.sh[2681]: Mailing List: https://lists.balabit.hu/mailman/listinfo/syslog-ng
@ikheifets-splunk ikheifets-splunk self-assigned this Feb 12, 2025
@ikheifets-splunk ikheifets-splunk linked a pull request Feb 12, 2025 that will close this issue
fix: baremetal release #2703
Open
@ikheifets-splunk
Copy link
Contributor

ikheifets-splunk commented Feb 12, 2025 •
edited
Loading

@yoann-ls can you please provide CSV files (like compliance_meta_by_source.csv). According to trackback also something wrong on that side

Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/conf.d/conflib/_common/p_compliance_meta.conf:2:5-2:24:
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 1 parser compliance_meta_by_source {
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 2-----> add-contextual-data(
Feb 12 14:07:27 ip-10-202-38-180 entrypoint.sh[2639]: 2-----> ^^^^^^^^^^^^^^^^^^^

I made PR with fixing that:

Feb 12 14:07:26 ip-10-202-38-180 entrypoint.sh[2638]: python3: can't open file '/source_ports_validator.py': [Errno 2] No such file or directory

but it's not a blocking of the work of SC4S

@yoann-ls
Copy link
Author

Sure here they are:
compliance_meta_by_source.conf:
(empty)

compliance_meta_by_source.conf.example:

filter f_test_test {
#   host("something-*" type(glob)) or
#   netmask(169.254.100.0/24)
    host("cannot_ever_happen")
};

compliance_meta_by_source.csv
(empty)

compliance_meta_by_source.csv.example

f_test_test,.splunk.index,"will_never_happen_index"
f_test_test,fields.compliance,"pci"

host.csv
(empty)

host.csv.example
169.254.0.2,HOST,foo.example

splunk_metadata.csv
(empty)

vendor_product_by_source.conf
(empty)

vendor_product_by_source.conf.example

filter f_tzfixny {
    host("tzfny-*" type(glob))
    #or netmask(xxx.xxx.xxx.xxx/xx)
};
#America/Chicago
filter f_tzfixchi {
    host("tzfchi-*" type(glob))
    #or netmask(xxx.xxx.xxx.xxx/xx)
};
filter f_f5{
    host('^test-f5') or "${HOST}" eq "f5_bigip"
};

vendor_product_by_source.csv
(empty)

vendor_product_by_source.csv.example

f_tzfixny,sc4s_time_zone,"America/New_York"
f_tzfixchi,sc4s_time_zone,"America/Chicago"
f_f5,sc4s_vendor_product,f5_bigip

@yoann-ls yoann-ls changed the title Errors when starting SC4S service in a bare metal deployement Errors when starting SC4S service in a bare metal deployment Feb 12, 2025
@rjha-splunk rjha-splunk added the Environment Issue and bug related to environment label Feb 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ikheifets-splunk ikheifets-splunk

Labels
Environment Issue and bug related to environment
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: baremetal release splunk/splunk-connect-for-syslog
3 participants
@yoann-ls @rjha-splunk @ikheifets-splunk