Apparently the example on the wiki is outdated, compared to the current version of
I crafted my own config based on the man page, available online or on a "full" Linux-based system. Mine does appear to be
@version:3.9 so things may have changed since then. Perhaps some clues on the 3.16 format at https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-guide/13#TOPIC-956435
The entries in
/var/ are not surprising for a sophisticated application that allows control over a socket.
Config is at
Author: W. Michael Petullo <mike@XXX>
Date: Sun Jul 15 20:18:24 2018 -0400
syslog-ng: update to 3.16.1
Signed-off-by: W. Michael Petullo <mike@XXX>
jeff@office:~$ syslog-ng --version
syslog-ng 3 (3.16.1)
Config version: 3.16
Yes, I do see similar messages in my running config
jeff@devel:~$ sudo /etc/init.d/syslog-ng restart
2018 Sep 18 10:51:03 devel notice syslog-ng: syslog-ng shutting down; version='3.16.1'
[2018-09-18T10:51:04.918484] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.16 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file.;
2018 Sep 18 10:51:05 devel notice syslog-ng: syslog-ng starting up; version='3.16.1'
Not a guarantee that your file is compatible with 3.16, but a quick edit of the header of mine to
@version:3.16 has quelled the warning and it seems to be running properly. I did this based on the logged message and the absence of any "warnings about incompatible changes".
To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file.