Troubleshooting

The Syslog Collector Installation Fails due to a Missing Dependency

If you encounter an error during the installation of the Syslog Collector due to missing dependencies, try the following solutions to resolve the issue and successfully complete the installation.

Solution 1: Use a Virtual Environment

If your environment is externally managed, you can create a virtual environment and install the dependencies within it.

  1. To create a virtual environment, run:

    python3 -m venv ~/myenv

  2. To activate the virtual environment, run:

    source ~/myenv/bin/activate

  3. To install Delinea Privileged Access Service (PAS) reporting tool, run:

    python3 /opt/delinea/pas/reporting_tool/setup/setup.py -t pass-t.internal -f 5 -s "all" -dep -off -p url:8080

    url is the URL of the proxy server that is used for network communications.

  4. To deactivate the virtual environment when you no longer need it, run:

    deactivate

Solution 2: Use pipx for the Installation

Some system environments enforce the use of pipx instead of pip for package installations. If pipx is not installed, install it by running the command for your Linux distribution:

Debian or Ubuntu

sudo apt install pipx

RHEL or Fedora

sudo dnf install pipx

To install Delinea Privileged Access Service (PAS) reporting tool using pipx, run:

pipx run /opt/delinea/pas/reporting_tool/setup/setup.py -t pass-t.internal -f 5 -s "all" -dep -off -p url:8080

The url:8080 refers to the proxy server's URL that will facilitate network communication. Replace url with the actual proxy server URL that your environment uses.

Troubleshooting TLS Verification

If delinea_syslog_writer cannot reach your Cloud Suite tenant because of a TLS certificate verification failure, /var/log/messages will contain a structured line that names the configured CA bundle and lists common causes:

TLS verification failed when calling https://<tenant> with ca_bundle=<value>. Common causes: the configured CA bundle does not contain the issuer of the tenant's certificate (for example, corporate TLS-intercepting proxy with a private root CA), an expired or wrong-host certificate on the tenant, or a missing system trust store.

To resolve:

  1. Obtain the PEM CA bundle from your network or security team.

  2. Copy it to an absolute path on the host (for example, /etc/pki/ca-trust/source/anchors/corporate-proxy.pem).

  3. Re-run setup with the --ca-bundle <absolute-path> flag.

If --ca-bundle is relative or points at a missing file, setup aborts immediately with one of:

  • --ca-bundle must be an absolute path; got: <value>

  • --ca-bundle path does not exist or is not a regular file: <value>

On every tick, a healthy installation logs the active bundle path (or None if the flag is unused):

TLS CA bundle: <value>

If config.json is hand-edited with an invalid method, frequency, or ca_bundle value, the writer logs the following at startup and exits:

Cannot continue: invalid method, frequency, or ca_bundle in config.