2

I'm running syslog-ng OSE on Ubuntu 24.04, using the official syslog-ng.com repo. I'm feeding logs to the OpenObserve HTTP destination.

destination d_openobserve_http { openobserve-log( url("https://REDACTED") port(443) organization("default") stream("syslog-ng") user("REDACTED") password("REDACTED") ); }; log { source(s_src); destination(d_openobserve_http); flags(flow-control); }; 

Since a recent update, probably syslog-ng 4.8.2, syslog-ng has started spamming the system log with many lines of debug info for every HTTP call to openobserve

syslog-ng[89285]: * Found bundle for host: 0x7cd07002c0a0 [serially] syslog-ng[89285]: * Can not multiplex, even if we wanted to syslog-ng[89285]: * Re-using existing connection with host REDACTED syslog-ng[89285]: * Server auth using Basic with user 'REDACTED' syslog-ng[89285]: > POST /api/default/syslog-ng/_json HTTP/1.1 syslog-ng[89285]: Host: REDACTED syslog-ng[89285]: Authorization: Basic REDACTED syslog-ng[89285]: User-Agent: syslog-ng 4.8.3/libcurl 8.5.0 syslog-ng[89285]: Accept: */* syslog-ng[89285]: Accept-Encoding: deflate, gzip, br, zstd syslog-ng[89285]: Connection: keep-alive syslog-ng[89285]: Content-Length: 5617 syslog-ng[89285]: Content-Type: application/x-www-form-urlencoded syslog-ng[89285]: syslog-ng[89285]: < HTTP/1.1 200 OK syslog-ng[89285]: < Server: nginx/1.24.0 (Ubuntu) syslog-ng[89285]: < Date: Sat, 24 May 2025 19:43:16 GMT syslog-ng[89285]: < Content-Type: application/json syslog-ng[89285]: < Transfer-Encoding: chunked syslog-ng[89285]: < Connection: keep-alive syslog-ng[89285]: < vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers syslog-ng[89285]: < vary: accept-encoding 

I've gone over the configuration and I can't find anything that would cause this to suddenly change.

syslog-ng is not running in "verbose" or "debug" mode, according to syslog-ng-ctl.

How do I make it stop logging this info?

3
  • 1
    There are two open GitHub issues about this behaviour: this and this. Commented May 25 at 13:16
  • Thank you @AlexD. I'll have to watch those issues. Commented May 25 at 17:53
  • 1
    Just FTR, AxoSyslog (a syslog-ng fork by the original creator of syslog-ng) is not affected by this bug. Check axoflow.com/blog/how-to-upgrade-syslog-ng-to-axosyslog if you'd like to give AxoSyslog a try. Commented May 26 at 7:53

0

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.