fix(syslog): don't close the shared acquisition output channel

The syslog datasource's Stream() does `defer close(out)` on the pipeline
output channel. That channel is shared: StartAcquisition() passes the same
`out` to every configured datasource, and it is owned by the acquisition
orchestrator, which never closes it (shutdown is driven by context
cancellation, then drainChan). syslog is the only datasource that closes it.

When syslog and another datasource run together, syslog's close races with
the other datasource still sending. This is reproducible with the AppSec
datasource: on shutdown/reload, an in-flight out-of-band request in
appsec_runner's handleOutBandInterrupt does `r.outChan <- evt` after syslog
has closed the channel, panicking with "send on closed channel" (seen in
production on 1.7.8 under a syslog+appsec config).

Remove the close. No consumer relies on it: runParse ranges via a
`select { case <-ctx.Done(); case ev := <-input }` loop and drainChan is a
non-blocking best-effort drain, so both terminate on context cancellation
regardless. This aligns syslog with every other datasource (file, journalctl,
docker, ...), none of which close the shared channel. Also documents the
"never close out" contract on the RestartableStreamer interface.

Author: alxrxs

pkg/acquisition/modules/syslog/run.go

@@ -43,8 +43,11 @@ func (s *Source) Stream(ctx context.Context, out chan pipeline.Event) error {
 	})
 
 	g.Go(func() error {
-		defer close(out)
-
+		// out is the shared pipeline output channel, fed by every configured
+		// datasource; it is owned by the acquisition orchestrator, not by this
+		// Stream(), so it must NOT be closed here. Doing so races with any other
+		// datasource still sending on it (e.g. an in-flight appsec out-of-band
+		// request) and panics with "send on closed channel".
 		for {
 			select {
 			case <-ctx.Done():

pkg/acquisition/types/types.go

@@ -76,6 +76,10 @@ type Fetcher interface {
 //    failures, but treat them as errors. The caller is responsible for supervising
 //    Stream(), and restarting it as needed. There is currently no way to differentiate
 //    retryable vs permanent errors.
+//  - never close the output channel: it is shared and fed by every configured
+//    datasource, so it is owned by the acquisition orchestrator, not by any single
+//    Stream() implementation. Closing it here would race with (and can panic) any
+//    other datasource still sending on it.
 type RestartableStreamer interface {
 	// Start live acquisition (eg, tail a file)
 	Stream(ctx context.Context, out chan pipeline.Event) error