[gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Helmut Jarausch]

I have syslog-ng-3.7.1 installed here.
Syslog-ng fails to start with the message:
Failed to seek to the Cursor cursor='', error='Success (0)'

Does anybody know what's happening?

Many thanks for a hint,
Helmut

Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Alan McKinnon]

On 16/09/2015 17:57, Helmut Jarausch wrote:
> I have syslog-ng-3.7.1 installed here.
> Syslog-ng fails to start with the message:
> Failed to seek to the Cursor cursor='', error='Success (0)'
> 
> Does anybody know what's happening?
> 
> Many thanks for a hint,
> Helmut
> 
> 


It has something to do with systemd's log thingy.

The error only appears in one place in the syslog-ng source,
in modules/systemd-journal/journal-reader.c:

static inline gboolean
__seek_to_saved_state(JournalReader *self)
{
  JournalReaderState *state =
persist_state_map_entry(self->persist_state, self->persist_handle);
  gint rc = journald_seek_cursor(self->journal, state->cursor);
  persist_state_unmap_entry(self->persist_state, self->persist_handle);
  if (rc != 0)
    {
      msg_warning("Failed to seek to the cursor",
          evt_tag_str("cursor", state->cursor),
          evt_tag_errno("error", errno),
          NULL);
      return __seek_to_head(self);
    }
  journald_next(self->journal);
  return TRUE;
}


First step would appear to be to check systemd's built-in log thingy


-- 
Alan McKinnon
alan.mckinnon@gmail.com

Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Helmut Jarausch]

On 09/16/2015 06:55:00 PM, Alan McKinnon wrote:
> On 16/09/2015 17:57, Helmut Jarausch wrote:
> > I have syslog-ng-3.7.1 installed here.
> > Syslog-ng fails to start with the message:
> > Failed to seek to the Cursor cursor='', error='Success (0)'
> >
> > Does anybody know what's happening?
> >
> > Many thanks for a hint,
> > Helmut
> >
> >
> 
> 
> It has something to do with systemd's log thingy.
> 
> The error only appears in one place in the syslog-ng source,
> in modules/systemd-journal/journal-reader.c:
> 
> static inline gboolean
> __seek_to_saved_state(JournalReader *self)
> {
>   JournalReaderState *state =
> persist_state_map_entry(self->persist_state, self->persist_handle);
>   gint rc = journald_seek_cursor(self->journal, state->cursor);
>   persist_state_unmap_entry(self->persist_state,
> self->persist_handle);
>   if (rc != 0)
>     {
>       msg_warning("Failed to seek to the cursor",
>           evt_tag_str("cursor", state->cursor),
>           evt_tag_errno("error", errno),
>           NULL);
>       return __seek_to_head(self);
>     }
>   journald_next(self->journal);
>   return TRUE;
> }
> 
> 
> First step would appear to be to check systemd's built-in log thingy
> 

Thanks Alan,

but how to do that. I have systemd installed here but I haven't ever used it since I'm using openrc.
So, what can I do?

Thanks,
Helmut

Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Alan McKinnon]

On 16/09/2015 20:52, Helmut Jarausch wrote:
> On 09/16/2015 06:55:00 PM, Alan McKinnon wrote:
>> On 16/09/2015 17:57, Helmut Jarausch wrote:
>>> I have syslog-ng-3.7.1 installed here.
>>> Syslog-ng fails to start with the message:
>>> Failed to seek to the Cursor cursor='', error='Success (0)'
>>>
>>> Does anybody know what's happening?
>>>
>>> Many thanks for a hint,
>>> Helmut
>>>
>>>
>>
>>
>> It has something to do with systemd's log thingy.
>>
>> The error only appears in one place in the syslog-ng source,
>> in modules/systemd-journal/journal-reader.c:
>>
>> static inline gboolean
>> __seek_to_saved_state(JournalReader *self)
>> {
>>   JournalReaderState *state =
>> persist_state_map_entry(self->persist_state, self->persist_handle);
>>   gint rc = journald_seek_cursor(self->journal, state->cursor);
>>   persist_state_unmap_entry(self->persist_state,
>> self->persist_handle);
>>   if (rc != 0)
>>     {
>>       msg_warning("Failed to seek to the cursor",
>>           evt_tag_str("cursor", state->cursor),
>>           evt_tag_errno("error", errno),
>>           NULL);
>>       return __seek_to_head(self);
>>     }
>>   journald_next(self->journal);
>>   return TRUE;
>> }
>>
>>
>> First step would appear to be to check systemd's built-in log thingy
>>
> 
> Thanks Alan,
> 
> but how to do that. I have systemd installed here but I haven't ever used it since I'm using openrc.
> So, what can I do?

Well you are one better than me.
I _don't_ have systemd installed here but I haven't ever used it since
I'm using openrc :-)

I haven't seen Canek for a few days, hopefully he'll drop by and help
you out - he's usually the one with the most useful systemd answers

-- 
Alan McKinnon
alan.mckinnon@gmail.com

Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Fernando Rodriguez]

On Wednesday, September 16, 2015 8:52:21 PM Helmut Jarausch wrote:
> On 09/16/2015 06:55:00 PM, Alan McKinnon wrote:
> > On 16/09/2015 17:57, Helmut Jarausch wrote:
> > > I have syslog-ng-3.7.1 installed here.
> > > Syslog-ng fails to start with the message:
> > > Failed to seek to the Cursor cursor='', error='Success (0)'
> > >
> > > Does anybody know what's happening?
> > >
> > > Many thanks for a hint,
> > > Helmut
> > >
> > >
> > 
> > 
> > It has something to do with systemd's log thingy.
> > 
> > The error only appears in one place in the syslog-ng source,
> > in modules/systemd-journal/journal-reader.c:
> > 
> > static inline gboolean
> > __seek_to_saved_state(JournalReader *self)
> > {
> >   JournalReaderState *state =
> > persist_state_map_entry(self->persist_state, self->persist_handle);
> >   gint rc = journald_seek_cursor(self->journal, state->cursor);
> >   persist_state_unmap_entry(self->persist_state,
> > self->persist_handle);
> >   if (rc != 0)
> >     {
> >       msg_warning("Failed to seek to the cursor",
> >           evt_tag_str("cursor", state->cursor),
> >           evt_tag_errno("error", errno),
> >           NULL);
> >       return __seek_to_head(self);
> >     }
> >   journald_next(self->journal);
> >   return TRUE;
> > }
> > 
> > 
> > First step would appear to be to check systemd's built-in log thingy
> > 
> 
> Thanks Alan,
> 
> but how to do that. I have systemd installed here but I haven't ever used it 
since I'm using openrc.
> So, what can I do?
> 
> Thanks,
> Helmut
> 
> 

Look for file named syslog-ng.persist somewhere in /var and delete it, then try 
restarting syslog-ng.

I also recommend you start playing with journalctl. I hated it for a while but 
mostly because I didn't knew how to use it. Now I love it and got rid of 
syslog-ng.

-- 
Fernando Rodriguez

Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Fernando Rodriguez]

On Wednesday, September 16, 2015 3:05:55 PM Fernando Rodriguez wrote:
> On Wednesday, September 16, 2015 8:52:21 PM Helmut Jarausch wrote:
> > On 09/16/2015 06:55:00 PM, Alan McKinnon wrote:
> > > On 16/09/2015 17:57, Helmut Jarausch wrote:
> > > > I have syslog-ng-3.7.1 installed here.
> > > > Syslog-ng fails to start with the message:
> > > > Failed to seek to the Cursor cursor='', error='Success (0)'
> > > >
> > > > Does anybody know what's happening?
> > > >
> > > > Many thanks for a hint,
> > > > Helmut
> > > >
> > > >
> > > 
> > > 
> > > It has something to do with systemd's log thingy.
> > > 
> > > The error only appears in one place in the syslog-ng source,
> > > in modules/systemd-journal/journal-reader.c:
> > > 
> > > static inline gboolean
> > > __seek_to_saved_state(JournalReader *self)
> > > {
> > >   JournalReaderState *state =
> > > persist_state_map_entry(self->persist_state, self->persist_handle);
> > >   gint rc = journald_seek_cursor(self->journal, state->cursor);
> > >   persist_state_unmap_entry(self->persist_state,
> > > self->persist_handle);
> > >   if (rc != 0)
> > >     {
> > >       msg_warning("Failed to seek to the cursor",
> > >           evt_tag_str("cursor", state->cursor),
> > >           evt_tag_errno("error", errno),
> > >           NULL);
> > >       return __seek_to_head(self);
> > >     }
> > >   journald_next(self->journal);
> > >   return TRUE;
> > > }
> > > 
> > > 
> > > First step would appear to be to check systemd's built-in log thingy
> > > 
> > 
> > Thanks Alan,
> > 
> > but how to do that. I have systemd installed here but I haven't ever used 
it 
> since I'm using openrc.
> > So, what can I do?
> > 
> > Thanks,
> > Helmut
> > 
> > 
> 
> Look for file named syslog-ng.persist somewhere in /var and delete it, then 
try 
> restarting syslog-ng.
> 
> I also recommend you start playing with journalctl. I hated it for a while 
but 
> mostly because I didn't knew how to use it. Now I love it and got rid of 
> syslog-ng.

Ops, I missed the part about not using systemd. If deleting that file doesn't 
fix it check if you have the systemd use flag enabled for syslog-ng and disable 
it. Are you using a systemd profile?

-- 
Fernando Rodriguez

Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Rich Freeman]

On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon <alan.mckinnon@gmail.com> wrote:
>
> It has something to do with systemd's log thingy.
>
> The error only appears in one place in the syslog-ng source,
> in modules/systemd-journal/journal-reader.c:
>
> static inline gboolean
> __seek_to_saved_state(JournalReader *self)
> {
>   JournalReaderState *state =
> persist_state_map_entry(self->persist_state, self->persist_handle);
>   gint rc = journald_seek_cursor(self->journal, state->cursor);
>   persist_state_unmap_entry(self->persist_state, self->persist_handle);
>   if (rc != 0)
>     {
>       msg_warning("Failed to seek to the cursor",
>           evt_tag_str("cursor", state->cursor),
>           evt_tag_errno("error", errno),
>           NULL);
>       return __seek_to_head(self);
>     }
>   journald_next(self->journal);
>   return TRUE;
> }
>

The other posts are getting at the solution - disable journal support
if you're not actually using systemd.

However, does syslog-ng actually READ logs?  My understanding is that
journal cursors are used to read logs, not to write them, and I
associate syslog-ng more with writing logs.

The concept is that when you query the journal every record gets
returned with a cursor, which is just a guid of some sort.  Then you
can run a later query and pass the last cursor you saw back and just
get a list of new records since the last one you read.  The use case
is for log monitors and such so that they can periodically poll the
log without having to read the entire thing from the beginning each
time.

-- 
Rich

Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Alan McKinnon]

On 16/09/2015 21:42, Rich Freeman wrote:
> On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon <alan.mckinnon@gmail.com> wrote:
>>
>> It has something to do with systemd's log thingy.
>>
>> The error only appears in one place in the syslog-ng source,
>> in modules/systemd-journal/journal-reader.c:
>>
>> static inline gboolean
>> __seek_to_saved_state(JournalReader *self)
>> {
>>   JournalReaderState *state =
>> persist_state_map_entry(self->persist_state, self->persist_handle);
>>   gint rc = journald_seek_cursor(self->journal, state->cursor);
>>   persist_state_unmap_entry(self->persist_state, self->persist_handle);
>>   if (rc != 0)
>>     {
>>       msg_warning("Failed to seek to the cursor",
>>           evt_tag_str("cursor", state->cursor),
>>           evt_tag_errno("error", errno),
>>           NULL);
>>       return __seek_to_head(self);
>>     }
>>   journald_next(self->journal);
>>   return TRUE;
>> }
>>
> 
> The other posts are getting at the solution - disable journal support
> if you're not actually using systemd.
> 
> However, does syslog-ng actually READ logs?  My understanding is that
> journal cursors are used to read logs, not to write them, and I
> associate syslog-ng more with writing logs.
> 
> The concept is that when you query the journal every record gets
> returned with a cursor, which is just a guid of some sort.  Then you
> can run a later query and pass the last cursor you saw back and just
> get a list of new records since the last one you read.  The use case
> is for log monitors and such so that they can periodically poll the
> log without having to read the entire thing from the beginning each
> time.
> 


Digging up ancient memory from other people's posts long ago:

Doesn't syslog-ng read systemd's log from early userspace startup
(before syslog-ng starts) and write those entries to syslog-ng?

-- 
Alan McKinnon
alan.mckinnon@gmail.com

Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Rich Freeman]

On Wed, Sep 16, 2015 at 3:57 PM, Alan McKinnon <alan.mckinnon@gmail.com> wrote:
> On 16/09/2015 21:42, Rich Freeman wrote:
>> On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon <alan.mckinnon@gmail.com> wrote:
>>>
>>> It has something to do with systemd's log thingy.
>>>
>>> The error only appears in one place in the syslog-ng source,
>>> in modules/systemd-journal/journal-reader.c:
>>>
>>> static inline gboolean
>>> __seek_to_saved_state(JournalReader *self)
>>> {
>>>   JournalReaderState *state =
>>> persist_state_map_entry(self->persist_state, self->persist_handle);
>>>   gint rc = journald_seek_cursor(self->journal, state->cursor);
>>>   persist_state_unmap_entry(self->persist_state, self->persist_handle);
>>>   if (rc != 0)
>>>     {
>>>       msg_warning("Failed to seek to the cursor",
>>>           evt_tag_str("cursor", state->cursor),
>>>           evt_tag_errno("error", errno),
>>>           NULL);
>>>       return __seek_to_head(self);
>>>     }
>>>   journald_next(self->journal);
>>>   return TRUE;
>>> }
>>>
>>
>> The other posts are getting at the solution - disable journal support
>> if you're not actually using systemd.
>>
>> However, does syslog-ng actually READ logs?  My understanding is that
>> journal cursors are used to read logs, not to write them, and I
>> associate syslog-ng more with writing logs.
>>
>> The concept is that when you query the journal every record gets
>> returned with a cursor, which is just a guid of some sort.  Then you
>> can run a later query and pass the last cursor you saw back and just
>> get a list of new records since the last one you read.  The use case
>> is for log monitors and such so that they can periodically poll the
>> log without having to read the entire thing from the beginning each
>> time.
>>
>
>
> Digging up ancient memory from other people's posts long ago:
>
> Doesn't syslog-ng read systemd's log from early userspace startup
> (before syslog-ng starts) and write those entries to syslog-ng?
>

Ah, that makes sense.  This isn't about recording syslog data in the
journal.  This is about recording journal data in syslog, for which
using cursors would be a completely obvious design.

-- 
Rich

Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Helmut Jarausch]

On 09/16/2015 09:19:58 PM, Fernando Rodriguez wrote:
> On Wednesday, September 16, 2015 3:05:55 PM Fernando Rodriguez wrote:
> > On Wednesday, September 16, 2015 8:52:21 PM Helmut Jarausch wrote:
> > > On 09/16/2015 06:55:00 PM, Alan McKinnon wrote:
> > > > On 16/09/2015 17:57, Helmut Jarausch wrote:
> > > > > I have syslog-ng-3.7.1 installed here.
> > > > > Syslog-ng fails to start with the message:
> > > > > Failed to seek to the Cursor cursor='', error='Success (0)'
> > > > >
> > > > > Does anybody know what's happening?
> > > > >
> > > > > Many thanks for a hint,
> > > > > Helmut
> > > > >
> > > > >
> > > >
> > > >
> > > > It has something to do with systemd's log thingy.
> > > >
> > > > The error only appears in one place in the syslog-ng source,
> > > > in modules/systemd-journal/journal-reader.c:
> > > >
> > > > static inline gboolean
> > > > __seek_to_saved_state(JournalReader *self)
> > > > {
> > > >   JournalReaderState *state =
> > > > persist_state_map_entry(self->persist_state,
> self->persist_handle);
> > > >   gint rc = journald_seek_cursor(self->journal, state->cursor);
> > > >   persist_state_unmap_entry(self->persist_state,
> > > > self->persist_handle);
> > > >   if (rc != 0)
> > > >     {
> > > >       msg_warning("Failed to seek to the cursor",
> > > >           evt_tag_str("cursor", state->cursor),
> > > >           evt_tag_errno("error", errno),
> > > >           NULL);
> > > >       return __seek_to_head(self);
> > > >     }
> > > >   journald_next(self->journal);
> > > >   return TRUE;
> > > > }
> > > >
> > > >
> > > > First step would appear to be to check systemd's built-in log
> thingy
> > > >
> > >
> > > Thanks Alan,
> > >
> > > but how to do that. I have systemd installed here but I haven't
> ever used
> it
> > since I'm using openrc.
> > > So, what can I do?
> > >
> > > Thanks,
> > > Helmut
> > >
> > >
> >
> > Look for file named syslog-ng.persist somewhere in /var and delete
> it, then
> try
> > restarting syslog-ng.
> >
> > I also recommend you start playing with journalctl. I hated it for a
> while
> but
> > mostly because I didn't knew how to use it. Now I love it and got
> rid of
> > syslog-ng.
> 
> Ops, I missed the part about not using systemd. If deleting that file
> doesn't
> fix it check if you have the systemd use flag enabled for syslog-ng
> and disable
> it. Are you using a systemd profile?
> 

Many thanks, Fernando, 
the systemd use-flag of syslog-ng was the culprit.
(no, I don't use a systemd profile)

Helmut.