I have a Syslog-ng server. there are many clients that send their log to the log server. the problem is sometimes there is no log for some clients in the log server, and sometimes there is no log for any of them. when this happen I do these steps:

  1. I check the syslog-ng service and it almost is active.
  2. I create a client for test, and I send this client's log to the log server. immediately after that, I see the log server start to record logs for those client that there is no log for them before. so for these some logs for a period of time don't exist.

    For example:






    The next log file is for example:


    So some log files are missed.

  3. Also I check UDP drop packets using ifconfig command and there is no dropped packet at all.

I check the log server's log and find these logs, but I'm not sure what problems they belong to:

Syslog,error,systemd-journald[225]: Failed to save stream data /run/systemd/journal/streams/8:6354381: Permission denied,"01 Jan 2018, 14:46:48

Syslog,error,"I/O error occurred while writing; fd='21', error='Operation not permitted (1)'","01 Jan 2018, 11:45:04

Syslog,error,"Error opening file for writing; filename='/mnt/remotelogs/syslog-services/', error='Permission denied (13)'","01 Jan 2018, 11:47:23"

Where is the problem? and how can I make the log server stable?


according to your error messages, you are writing your log files into a mounted directory. My guess is that the connection to this remote host is unstable, and this causes problems for syslog-ng. If you are using NFS, I'd recommend the following:

  • USE at least NFS v4
  • USE the soft mount option (-o soft) to mount the partition
  • USE the TCP mount option (-o tcp) to mount the partition
  • DO NOT store the runtime files (for example, the configuration or the persist file) of syslog-ng on a mounted partition


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.