.TH syslog\-ng\-debun 1 "18 December 2025" 4.10.2 "The syslog\-ng\-debun manual page" .SH NAME .PP syslog\-ng\-debun \-\-\- syslog\-ng DEBUg buNdle generator .SH SYNOPSIS .PP syslog\-ng\-debun [options] .SH DESCRIPTION .PP \fBNOTE:\fP The syslog\-ng\-debun application is distributed with the syslog\-ng OSE system logging application, and is usually part of the syslog\-ng OSE package. The latest version of the syslog\-ng OSE application is available at the syslog\-ng OSE page. .PP This manual page is only an abstract. .PP The syslog\-ng\-debun tool collects and saves information about your syslog\-ng OSE installation, making troubleshooting easier, especially if you ask help about your syslog\-ng OSE related problem. .SH GENERAL OPTIONS .PP \fB\fC\-r\fR Run syslog\-ng\-debun. Using this option is required to actually execute the data collection with syslog\-ng\-debun. It is needed to prevent accidentally running syslog\-ng\-debun. .PP \fB\fC\-h\fR Display the help page. .PP \fB\fC\-l\fR Do not collect privacy\-sensitive data, for example, process tree, fstab, and so on. If you use with \-d, then the following parameters will be used for debug mode:\-Fev .PP \fB\fC\-R \fR The directory where syslog\-ng PE is installed instead of /opt/syslog\-ng. .PP \fB\fC\-W \fR Set the working directory, where the debug bundle will be saved. Default value: /tmp. The name of the created file is syslog.debun.${host}.${date}.${3\-random\-characters\-or\-pid}.tgz .SH DEBUG MODE OPTIONS .PP \fB\fC\-d\fR Start syslog\-ng OSE in debug mode, using the \-Fedv \-\-enable\-core options. .PP .RS .nf ![](/assets/images/caution.png) **CAUTION:** Using this option under high message load may increase disk I/O during the debug, and the resulting debug bundle can be huge. To exit debug mode, press Enter. .fi .RE .PP \fB\fC\-D \fR Start syslog\-ng OSE in debug mode, using the specified command\-line options. To exit debug mode, press Enter. .PP \fB\fC\-t \fR Run syslog\-ng OSE in noninteractive debug mode for , and automatically exit debug mode after the specified number of seconds. .PP \fB\fC\-w \fR Wait seconds before starting debug mode. .SH SYSTEM CALL TRACING .PP \fB\fC\-s\fR Enable syscall tracing (strace \-f or truss \-f). Note that using \fB\fC\-s\fR itself does not enable debug mode, only traces the system calls of an already running syslog\-ng OSE process. To trace system calls in debug mode, use both the \fB\fC\-s\fR and \fB\fC\-d\fR options. .SH PACKET CAPTURE OPTIONS .PP Capturing packets requires a packet capture tool on the host. The syslog\-ng\-debun tool attempts to use tcpdump on most platforms, except for Solaris, where it uses snoop. .PP \fB\fC\-i \fR Capture packets only on the specified interface, for example, eth0. .PP \fB\fC\-p\fR Capture incoming packets using the following filter: port 514 or port 601 or port 53 .PP \fB\fC\-P \fR Capture incoming packets using the specified filter. .PP \fB\fC\-t \fR Run syslog\-ng OSE in noninteractive debug mode for , and automatically exit debug mode after the specified number of seconds. .SS EXAMPLES: .PP .RS .nf syslog\-ng\-debun \-r .fi .RE .PP Create a simple debug bundle, collecting information about your environment, for example, list packages containing the word: syslog, ldd of your syslog\-binary, and so on. .PP .RS .nf syslog\-ng\-debun \-r \-l .fi .RE .PP Similar to syslog\-ng\-debun \-r, but without privacy\-sensitive information. For example, the following is NOT collected: fstab, df output, mount info, ip / network interface configuration, DNS resolv info, and process tree. .PP .RS .nf syslog\-ng\-debun \-r \-d .fi .RE .PP Similar to syslog\-ng\-debun \-r, but it also stops syslog\-ng OSE, then restarts it in debug mode (\-Fedv \-\-enable\-core). To stop debug mode, press Enter. The output of the debug mode collected into a separate file, and also added to the debug bundle. .PP .RS .nf syslog\-ng\-debun \-r \-s .fi .RE .PP Trace the system calls (using strace or truss) of an already running syslog\-ng OSE process. .PP .RS .nf syslog\-ng\-debun \-r \-d \-s .fi .RE .PP Restart syslog\-ng OSE in debug mode, and also trace the system calls (using strace or truss) of the syslog\-ng OSE process. .PP .RS .nf syslog\-ng\-debun \-r \-p .fi .RE .PP Run packet capture (pcap) with the filter: port 514 or port 601 or port 53 Also waits for pressing Enter, like debug mode. .PP .RS .nf syslog\-ng\-debun \-r \-p \-t 10 .fi .RE .PP Noninteractive debug mode: Similar to syslog\-ng\-debun \-r \-p, but automatically exit after 10 seconds. .PP .RS .nf syslog\-ng\-debun \-r \-P "host 1.2.3.4" \-D "\-Fev \-\-enable\-core" .fi .RE .PP Change the packet\-capturing filter from the default to host 1.2.3.4. Also change debugging parameters from the default to \-Fev \-\-enable\-core. Since a timeout (\-t) is not given, waits for pressing Enter. .PP .RS .nf syslog\-ng\-debun \-r \-p \-d \-w 5 \-t 10 .fi .RE .PP Collect pcap and debug mode output following this scenario: .RS .IP \(bu 2 Start packet capture with default parameters (\-p) .IP \(bu 2 Wait 5 seconds (\-w 5) .IP \(bu 2 Stop syslog\-ng .IP \(bu 2 Start syslog\-ng OSE in debug mode with default parameters (\-d) .IP \(bu 2 Wait 10 seconds (\-t 10) .IP \(bu 2 Stop syslog\-ng OSE debuging .IP \(bu 2 Start syslog\-ng OSE .IP \(bu 2 Stop packet capturing .RE .SH FILES .PP /Users/hofi/Develop/Balabit/syslog-ng/build/install/bin/loggen .PP \fBNOTE:\fP If you experience any problems or need help with syslog\-ng OSE, see the \fIsyslog\-ng OSE Administration Guide\fP[1], or visit the \fIsyslog\-ng OSE mailing list\fP[2]. For news and notifications about syslog\-ng OSE, visit the \fIsyslog\-ng OSE blogs\fP[3]. .SH AUTHOR .PP This manual page was generated from the \fIsyslog\-ng OSE Administration Guide\fP[1], which was written by several contributors to whom we'd like to extend our sincere thanks. .SH COPYRIGHT .SH NOTES .PP [1] \fB\fCsyslog\-ng OSE Administration Guide\fR \[la]https://syslog-ng.github.io/admin-guide/README\[ra] .PP [2] \fB\fCsyslog\-ng OSE mailing list\fR \[la]https://lists.balabit.hu/mailman/listinfo/syslog-ng\[ra] .PP [3] \fB\fCsyslog\-ng OSE blogs\fR \[la]https://syslog-ng.com/blog/\[ra]