[gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Helmut Jarausch]

I have syslog-ng-3.7.1 installed here.
Syslog-ng fails to start with the message:
Failed to seek to the Cursor cursor='', error='Success (0)'

Does anybody know what's happening?

Many thanks for a hint,
Helmut

[Alan McKinnon]

It has something to do with systemd's log thingy.

The error only appears in one place in the syslog-ng source,
in modules/systemd-journal/journal-reader.c:

static inline gboolean
__seek_to_saved_state(JournalReader *self)
{
JournalReaderState *state =
persist_state_map_entry(self->persist_state, self->persist_handle);
gint rc = journald_seek_cursor(self->journal, state->cursor);
persist_state_unmap_entry(self->persist_state, self->persist_handle);
if (rc != 0)
{
msg_warning("Failed to seek to the cursor",
evt_tag_str("cursor", state->cursor),
evt_tag_errno("error", errno),
NULL);
return __seek_to_head(self);
}
journald_next(self->journal);
return TRUE;
}


First step would appear to be to check systemd's built-in log thingy


--
Alan McKinnon
alan.m...@gmail.com

[Helmut Jarausch]

Thanks Alan,

but how to do that. I have systemd installed here but I haven't ever used it since I'm using openrc.
So, what can I do?

Thanks,
Helmut

[Alan McKinnon]

Well you are one better than me.
I _don't_ have systemd installed here but I haven't ever used it since
I'm using openrc :-)

I haven't seen Canek for a few days, hopefully he'll drop by and help
you out - he's usually the one with the most useful systemd answers

--
Alan McKinnon
alan.m...@gmail.com

[Fernando Rodriguez]

Look for file named syslog-ng.persist somewhere in /var and delete it, then try
restarting syslog-ng.

I also recommend you start playing with journalctl. I hated it for a while but
mostly because I didn't knew how to use it. Now I love it and got rid of
syslog-ng.

--
Fernando Rodriguez

[Fernando Rodriguez]

Ops, I missed the part about not using systemd. If deleting that file doesn't
fix it check if you have the systemd use flag enabled for syslog-ng and disable
it. Are you using a systemd profile?

--
Fernando Rodriguez

[Rich Freeman]

On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon <alan.m...@gmail.com> wrote:
>
> It has something to do with systemd's log thingy.
>
> The error only appears in one place in the syslog-ng source,
> in modules/systemd-journal/journal-reader.c:
>
> static inline gboolean
> __seek_to_saved_state(JournalReader *self)
> {
> JournalReaderState *state =
> persist_state_map_entry(self->persist_state, self->persist_handle);
> gint rc = journald_seek_cursor(self->journal, state->cursor);
> persist_state_unmap_entry(self->persist_state, self->persist_handle);
> if (rc != 0)
> {
> msg_warning("Failed to seek to the cursor",
> evt_tag_str("cursor", state->cursor),
> evt_tag_errno("error", errno),
> NULL);
> return __seek_to_head(self);
> }
> journald_next(self->journal);
> return TRUE;
> }
>

The other posts are getting at the solution - disable journal support
if you're not actually using systemd.

However, does syslog-ng actually READ logs? My understanding is that
journal cursors are used to read logs, not to write them, and I
associate syslog-ng more with writing logs.

The concept is that when you query the journal every record gets
returned with a cursor, which is just a guid of some sort. Then you
can run a later query and pass the last cursor you saw back and just
get a list of new records since the last one you read. The use case
is for log monitors and such so that they can periodically poll the
log without having to read the entire thing from the beginning each
time.

--
Rich

[Alan McKinnon]

Digging up ancient memory from other people's posts long ago:

Doesn't syslog-ng read systemd's log from early userspace startup
(before syslog-ng starts) and write those entries to syslog-ng?

--
Alan McKinnon
alan.m...@gmail.com

[Rich Freeman]

Ah, that makes sense. This isn't about recording syslog data in the
journal. This is about recording journal data in syslog, for which
using cursors would be a completely obvious design.

--
Rich

[Helmut Jarausch]

Many thanks, Fernando,
the systemd use-flag of syslog-ng was the culprit.
(no, I don't use a systemd profile)

Helmut.