syslog-ng-debun(1)

📦
version 4.12.0 · 13 versions
, in alpine 3.24, arch rolling, fedora 44, nixpkgs unstable

✨ NAME ✨

syslog-ng-debun — the syslog-ng DEBUg buNdle generator, aka the little bestie that gathers receipts for you 💅

🌸 SYNOPSIS 🌸

syslog-ng-debun [options]

💖 DESCRIPTION 💖

NOTE: The syslog-ng-debun application is distributed with the syslog-ng OSE system logging application, and is usually part of the syslog-ng OSE package. The latest version of the syslog-ng OSE application is available at the syslog-ng OSE page.

okay so first thing's first: this manual page is only an abstract. That's the whole vibe — it's the trailer, not the movie 🎬

So what does syslog-ng-debun actually do? It collects and saves information about your syslog-ng OSE installation, which makes troubleshooting way easier — especially if you're asking for help with a syslog-ng OSE related problem. It's literally giving "here's everything, pls help me" energy and honestly? Iconic. 🫶

👑 GENERAL OPTIONS 👑

  • -r — Run syslog-ng-debun. Like, actually. Using this option is required to really execute the data collection with syslog-ng-debun. It exists so you don't accidentally run syslog-ng-debun — no cap, it's a safety rail and we respect it. 🛑
  • -h — Display the help page.
  • -l — Do not collect privacy-sensitive data, for example, process tree, fstab, and so on. If you use it with -d, then the following parameters will be used for debug mode: -Fev
  • -R <directory> — The directory where syslog-ng PE is installed instead of /opt/syslog-ng.
  • -W <directory> — Set the working directory, where the debug bundle will be saved. Default value: /tmp. The name of the created file is syslog.debun.${host}.${date}.${3-random-characters-or-pid}.tgz 📦

🔥 DEBUG MODE OPTIONS 🔥

  • -d — Start syslog-ng OSE in debug mode, using the -Fedv --enable-core options.
⚠️ CAUTION: Using this option under high message load may increase disk I/O during the debug, and the resulting debug bundle can be huge. To exit debug mode, press Enter.
  • -D <options> — Start syslog-ng OSE in debug mode, using the specified command-line options. To exit debug mode, press Enter.
  • -t <seconds> — Run syslog-ng OSE in noninteractive debug mode for <seconds>, and automatically exit debug mode after the specified number of seconds. ⏱️
  • -w <seconds> — Wait <seconds> seconds before starting debug mode.

🦋 SYSTEM CALL TRACING 🦋

  • -s — Enable syscall tracing (strace -f or truss -f). Note that using -s by itself does not enable debug mode, only traces the system calls of an already running syslog-ng OSE process. To trace system calls in debug mode, use both the -s and -d options. Sibling energy fr fr 👯

🎀 PACKET CAPTURE OPTIONS 🎀

Capturing packets requires a packet capture tool on the host. The syslog-ng-debun tool attempts to use tcpdump on most platforms, except for Solaris, where it uses snoop. 🌈

  • -i <interface> — Capture packets only on the specified interface, for example, eth0.
  • -p — Capture incoming packets using the following filter: port 514 or port 601 or port 53
  • -P <options> — Capture incoming packets using the specified filter.
  • -t <seconds> — Run syslog-ng OSE in noninteractive debug mode for <seconds>, and automatically exit debug mode after the specified number of seconds.

⭐ EXAMPLES: ⭐

syslog-ng-debun -r

Create a simple debug bundle, collecting information about your environment, for example, list packages containing the word: syslog, ldd of your syslog-binary, and so on.

syslog-ng-debun -r -l

Similar to syslog-ng-debun -r, but without privacy-sensitive information. For example, the following is NOT collected: fstab, df output, mount info, ip / network interface configuration, DNS resolv info, and process tree. 🕵️♀️

syslog-ng-debun -r -d

Similar to syslog-ng-debun -r, but it also stops syslog-ng OSE, then restarts it in debug mode (-Fedv --enable-core). To stop debug mode, press Enter. The output of the debug mode collected into a separate file, and also added to the debug bundle.

syslog-ng-debun -r -s

Trace the system calls (using strace or truss) of an already running syslog-ng OSE process.

syslog-ng-debun -r -d -s

Restart syslog-ng OSE in debug mode, and also trace the system calls (using strace or truss) of the syslog-ng OSE process.

syslog-ng-debun -r -p

Run packet capture (pcap) with the filter: port 514 or port 601 or port 53 Also waits for pressing Enter, like debug mode.

syslog-ng-debun -r -p -t 10

Noninteractive debug mode: Similar to syslog-ng-debun -r -p, but automatically exit after 10 seconds.

syslog-ng-debun -r -P "host 1.2.3.4"  -D "-Fev --enable-core"

Change the packet-capturing filter from the default to host 1.2.3.4. Also change debugging parameters from the default to -Fev --enable-core. Since a timeout (-t) is not given, waits for pressing Enter.

syslog-ng-debun -r -p -d -w 5 -t 10

Collect pcap and debug mode output following this scenario — the whole choreography, bestie 💃:

  • Start packet capture with default parameters (-p)
  • Wait 5 seconds (-w 5)
  • Stop syslog-ng
  • Start syslog-ng OSE in debug mode with default parameters (-d)
  • Wait 10 seconds (-t 10)
  • Stop syslog-ng OSE debuging
  • Start syslog-ng OSE
  • Stop packet capturing

🍓 FILES 🍓

/Users/hofi/Develop/Balabit/syslog-ng/build/install/bin/loggen
NOTE: If you experience any problems or need help with syslog-ng OSE, see the syslog-ng OSE Administration Guide[1], or visit the syslog-ng OSE mailing list[2]. For news and notifications about syslog-ng OSE, visit the syslog-ng OSE blogs[3].

💜 AUTHOR 💜

This manual page was generated from the syslog-ng OSE Administration Guide[1], which was written by several contributors to whom we'd like to extend our sincere thanks. 🫶 shoutout to the contributors, genuinely the realest

(no text here in the original — just the heading, sitting there looking cute and mysterious 🙈)

🧚 NOTES 🧚

okay that's the whole page, bestie, you ate that 💅✨ this was version 4.10.2, dated 18 December 2025 — go forth and bundle those debugs, you've got this 👑💖

📦 where this page comes from