当 apparmor 运行时，我无法启动 syslog-ng，因为它抱怨无法找到系统插件：
service apparmor start
* Starting AppArmor ...
* Loading AppArmor profiles ...
服务 syslog-ng 重新启动
- 警告：您正在停止启动服务 * 正在停止 syslog-ng ... [ ok ] * 检查您的配置文件 (/etc/syslog-ng/syslog-ng.conf) ... 解析源时出错，源插件系统未在中找到/etc/syslog-ng/syslog-ng.conf 第 24 行第 14 列：
源 src { 系统();内部的（）; }; ^^^^^^
syslog-ng 文档： http://www.balabit.com/support/documentation/?product=syslog-ng 邮件列表：https://lists.balabit.hu/mailman/listinfo/syslog-ng * 配置错误。请修复您的配置文件 (/etc/syslog-ng/syslog-ng.conf)
[!! ] * 错误：syslog-ng 启动失败
现在，一旦我停止apparmor：service apparmor stop
* Stopping AppArmor ...
* Unloading AppArmor profiles
service syslog-ng restart
* Checking your configfile (/etc/syslog-ng/syslog-ng.conf) ... [ ok ]
* Starting syslog-ng ...
这是我的 syslog-ng apparmor 规则：
# ------------------------------------------------------------------
#
# Copyright (C) 2006-2009 Novell/SUSE
# Copyright (C) 2006 Christian Boltz
# Copyright (C) 2010 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
#include <tunables/global>
#define this to be where syslog-ng is chrooted
@{CHROOT_BASE}=""
profile syslog-ng /{usr/,}sbin/syslog-ng {
#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/nameservice>
#include <abstractions/mysql>
#include <abstractions/openssl>
capability chown,
capability dac_override,
capability dac_read_search,
capability fsetid,
capability fowner,
capability sys_tty_config,
capability sys_resource,
capability syslog,
unix (receive) type=dgram,
unix (receive) type=stream,
/dev/kmsg r,
/dev/log w,
/dev/syslog w,
/dev/tty10 rw,
/dev/xconsole rw,
/etc/machine-id r,
/etc/syslog-ng/* r,
/etc/syslog-ng/conf.d/ r,
/etc/syslog-ng/conf.d/* r,
@{PROC}/kmsg r,
/etc/hosts.deny r,
/etc/hosts.allow r,
/{usr/,}sbin/syslog-ng mr,
/sys/devices/system/cpu/online r,
/usr/share/syslog-ng/** r,
/usr/lib/syslog-ng/** r,
/usr/lib64/syslog-ng/** r,
/usr/share/include/scl/** r,
/var/lib/syslog-ng/syslog-ng-?????.qf rw,
# chrooted applications
@{CHROOT_BASE}/var/lib/*/dev/log w,
@{CHROOT_BASE}/var/lib/syslog-ng/syslog-ng.persist* rw,
@{CHROOT_BASE}/var/log/** w,
@{CHROOT_BASE}/{,var/}run/syslog-ng.pid krw,
@{CHROOT_BASE}/{,var/}run/syslog-ng.ctl rw,
@{CHROOT_BASE}/usr/lib/syslog-ng/** r,
@{CHROOT_BASE}/usr/lib64/syslog-ng/** r,
@{CHROOT_BASE}/usr/share/include/scl/** r,
/{var,var/run,run}/log/journal/ r,
/{var,var/run,run}/log/journal/*/ r,
/{var,var/run,run}/log/journal/*/*.journal r,
/{var/,}run/syslog-ng.ctl a,
/{var/,}run/syslog-ng/additional-log-sockets.conf r,
# Site-specific additions and overrides. See local/README for details.
#include <local/sbin.syslog-ng>
}
注意 1：我编辑了此内容，因为我尝试了以下解决方案，我将 /dev/kmsg r 添加到 syslog-ng 所需的权限列表中，并最终遇到了相同的问题。我还应该注意的是，我使用的是 funtoo/gentoo linux，其 root 由 EXT4 Overlayfs 支持。我将检查 strace 的输出。
注意 2：我运行了 strace，但没有看到任何明显的东西，我正在使用 strace syslog-ng。如果我在 syslog-ng.conf 配置文件中注释掉该问题，它就会偶然发现目标。 /usr/lib64/syslog-ng/** r 应该支持这两个，对吧？
strace（截断）：
access("/etc/syslog-ng/scl/*/*.conf", F_OK) = -1 ENOENT (No such file or directory)
access("/usr/share/include/scl/*/*.conf", F_OK) = -1 ENOENT (No such file or directory)
open("/etc/syslog-ng/scl", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/usr/share/include/scl", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 EACCES (Permission denied)
write(2, "[2017-12-25T11:13:53.068758] Err"..., 128[2017-12-25T11:13:53.068758] Error processing path for inclusion; path='/usr/share/include/scl', errno='Permission denied (13)'
) = 128
write(2, "[2017-12-25T11:13:53.068790] Fin"..., 94[2017-12-25T11:13:53.068790] Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1'
) = 94
close(11) = 0
write(2, "[2017-12-25T11:13:53.068844] Rea"..., 93[2017-12-25T11:13:53.068844] Reading path for candidate modules; path='/usr/lib64/syslog-ng'
) = 93
open("/usr/lib64/syslog-ng", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 EACCES (Permission denied)
open("/usr/lib64/charset.alias", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/lib64/gconv/gconv-modules.cache", O_RDONLY) = 11
fstat(11, {st_mode=S_IFREG|0644, st_size=26244, ...}) = 0
mmap(NULL, 26244, PROT_READ, MAP_SHARED, 11, 0) = 0x7f1df6c84000
close(11) = 0
futex(0x7f1df62928e8, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f1df67c0428, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f1df67c0428, FUTEX_WAKE_PRIVATE, 2147483647) = 0
open("/proc/self/maps", O_RDONLY|O_CLOEXEC) = 11
fstat(11, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(11, "00400000-00402000 r-xp 00000000 "..., 1024) = 1024
read(11, "r--p 00004000 fe:02 7236 "..., 1024) = 1024
read(11, " /lib64/libdl-2.23.so\n7f1df4"..., 1024) = 1024
read(11, " /usr/lib64/lib"..., 1024) = 1024
read(11, "ib64/libgthread-2.0.so.0.4800.2\n"..., 1024) = 1024
read(11, "--p 00006000 fe:02 7273 "..., 1024) = 1024
read(11, "0 \n7f1df64b3000-7f1df65bf000 r-x"..., 1024) = 1024
close(11) = 0
write(2, "Error parsing source, source plu"..., 109Error parsing source, source plugin system not found in /etc/syslog-ng/syslog-ng.conf at line 24, column 14:
) = 109
open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 11
fstat(11, {st_mode=S_IFREG|0644, st_size=1498, ...}) = 0
read(11, "@version: 3.7\n#\n# Syslog-ng defa"..., 4096) = 1498
close(11) = 0
write(2, "\nsource src { system(); internal"..., 39
source src { system(); internal(); };
) = 39
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, " ", 1 ) = 1
write(2, "^", 1^) = 1
write(2, "^", 1^) = 1
write(2, "^", 1^) = 1
write(2, "^", 1^) = 1
write(2, "^", 1^) = 1
write(2, "^", 1^) = 1
write(2, "\n", 1
) = 1
write(2, "\nsyslog-ng documentation: http:/"..., 156
syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng
) = 156
close(10) = 0
exit_group(1) = ?
+++ exited with 1 +++
syslog-ng.conf：
@version: 3.7
@include "scl.conf"
options {
threaded(yes);
chain_hostnames(no);
stats_freq(43200);
mark_freq(3600);
};
source src { system(); internal(); };
destination messages { file("/var/log/messages" owner("logstash") group("logstash"));};
log { source(src); destination(messages); };
destination remote_log_server {udp("router" port(514));};
log { source(src); destination(remote_log_server); };
答案1
不幸的是，您还没有发布您的 syslog-ng 配置，所以我只是根据我自己对此类错误的经验进行猜测。
该错误消息有点误导。当前的 apparmor 配置文件阻止syslog-ng访问多个文件。一个常见的问题是/dev/kmsg，当使用与此类似的源时需要它：
source kernsrc {
file("/proc/kmsg");
};
尽管应该通过 访问该文件/proc/kmsg，但 syslog-ng 在继续之前会检查一些条件/dev/kmsg（使用 进行检查strace）。由于syslog-ng不允许读取该文件，因此无法启动。
我已经将此错误提交给 apparmor-profiles bugtracker这里。
同时，您可以通过手动编辑配置文件以允许syslog-ng读取来解决此问题/dev/kmsg。将此权限行添加到 apparmor 配置文件列表中的某处syslog-ng，可能是/etc/apparmor.d/sbin.syslog-ng：
/dev/kmsg r,