[BUG] Error parsing config when using MQTT

[iridris]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Attempting to set up an MQTT destination results in an error parsing config. I originally thought it was related to this issue, but I was able to eliminate the cloud_auth error by rolling back to version 4.1.1-r2-ls99 with no change to the MQTT error.

This is a new setup of syslog-ng, and I'm using the official documentation to set up a very basic log source & destination.

Expected Behavior

syslog-ng should start without an error parsing, and should log to an MQTT destination.

Steps To Reproduce

Set up syslog-ng with a basic configuration, and attempt to add an MQTT destination. Syslog-ng will then fail to start and will log a parsing error.

Environment

- OS: Raspbian
- How docker service was installed: sudo apt-get install docker-compose

syslog-ng.conf:

#############################################################################
# Default syslog-ng.conf file which collects all local logs into a
# single file called /var/log/messages tailored to container usage.

@version: 4.1
@include "scl.conf"

source s_local {
  internal();
};

source s_network_tcp {
  syslog(transport(tcp) port(6601));
};

source s_network_udp {
  syslog(transport(udp) port(5514));
};

destination d_local {
  file("/var/log/messages");
  file("/var/log/messages-kv.log" template("$ISODATE $HOST $(format-welf --scope all-nv-pairs)\n") frac-digits(3));
};

destination d_mqtt {
  mqtt(topic("router/dhcp/eth1"), address("tcp://myhost:1883"), username("myuser"), password("mypassword"));
};

log {
  source(s_local);
  source(s_network_tcp);
  source(s_network_udp);
  parser(panos-parser());
  destination(d_local);
  if (message("DHCP"))
  {
    destination(d_mqtt);
  };
};

### CPU architecture

arm64

### Docker creation

```bash
---
services:
  syslog-ng:
    image: lscr.io/linuxserver/syslog-ng:4.1.1-r2-ls99
    container_name: syslog-ng
    environment:
      - PUID=1000
      - PGID=1000
      - TZ='America/New_York'
    volumes:
      - /home/steve/docker/syslog-ng/config:/config
      - /home/steve/docker/syslog-ng/log:/var/log
    ports:
      - 514:5514/udp
      - 601:6601/tcp
      - 6514:6514/tcp
    restart: unless-stopped

Container logs

Logs from `docker logs syslog-ng`:

[migrations] started
[migrations] no migrations found
usermod: no changes
───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    1000
User GID:    1000
───────────────────────────────────────

[custom-init] No custom files found, skipping...
[ls.io-init] done.

Logs from syslog-ng itself (config/log/current):

2024-06-02 18:16:55.699826612  Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /config/syslog-ng.conf:26:3-26:7:
2024-06-02 18:16:55.699999128  21        file("/var/log/messages");
2024-06-02 18:16:55.700063794  22        file("/var/log/messages-kv.log" template("$ISODATE $HOST $(format-welf --scope all-nv-pairs)\n") frac-digits(3));
2024-06-02 18:16:55.700070035  23      };
2024-06-02 18:16:55.700073868  24
2024-06-02 18:16:55.700078387  25      destination d_mqtt {
2024-06-02 18:16:55.700140627  26---->   mqtt(topic("router/dhcp/eth1"), address("tcp://myhost:1883"), username("myuser"), password("mypassword"));
2024-06-02 18:16:55.700198459  26---->   ^^^^
2024-06-02 18:16:55.700204126  27      };
2024-06-02 18:16:55.700207552  28
2024-06-02 18:16:55.700211107  29      log {
2024-06-02 18:16:55.700215200  30        source(s_local);
2024-06-02 18:16:55.700271329  31        source(s_network_tcp);
2024-06-02 18:16:55.700445938
2024-06-02 18:16:55.700452012
2024-06-02 18:16:55.700459827  syslog-ng documentation: https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition
2024-06-02 18:16:55.700463364  contact:
2024-06-02 18:16:55.700468789   GitHub Project: https://github.com/syslog-ng/syslog-ng
2024-06-02 18:16:55.700474604   Chat with the Developers: https://gitter.im/syslog-ng/syslog-ng
2024-06-02 18:16:55.700480363   Mailing List: https://lists.balabit.hu/mailman/listinfo/syslog-ng

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[thespad]

It doesn't look like Alpine currently package the syslog-ng-mqtt module https://pkgs.alpinelinux.org/packages?name=syslog-ng*&branch=v3.20&repo=&arch=x86_64, you'd have to open an issue on their Gitlab and request it be added for us to be able to include it in the image.

[iridris]

Thanks @thespad, I had assumed MQTT would work since it's included in the docker file. I'll open a request over on Alpine's Gitlab instead.

[thespad]

It was included as a pre-req, but I hadn't really clocked that the mqtt module wasn't there, making it a bit redundant.

[iridris]

I've posted on the Alpine Gitlab requesting the MQTT package for syslog-ng. Fingers crossed it gets implemented.

https://gitlab.alpinelinux.org/alpine/aports/-/issues/16179

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[aderusha]

Still failing, cannot use MQTT functionality.

[iridris]

@thespad do you have any suggestions on how to get the issue over in Alpine's Gitlab to move forward? It's been open for ~9 months now. I've done some of the initial research into the issue, but I've reached the point where I can't do anything else until someone that knows what they're doing can take a look.