Syslog monitor addon beta

[pyoung]

The only cronjobs should be poller.php and fastpoller.php (latter for CactiEZ)

Poller.php in turn calls cactid (based on your Settings via the www page). Its cactid vs cmd.php, either initiated from poller.php

You don't run cactid manually.

After getting a good nights (or 3, the holiday weekend was just what I needed, heh.) sleep, I checked again, and you are of course correct - sorry for the silly question.

[Lcd]

Hi all

It's a great plugin but i have a problem ^^

When it is activated i have a php process wich is launched a bit after the polling cycle wich discuss with the mysqld daemon (i suppose because the mysqld grows in ressources too).
And it does it without end and takes all the server ressources....
Moreover, this php process is recalled after each polling cycle...so i find myself with 4,5,6....process taking all the ressources....

I'm not sure of the script that does it but it seem's to me that i saw the syslog_process.php name....

The database is filled in by syslog-ng and i have no problems with it

So if anyone have an idea about it it would be great ^^

[Lcd]

Hi

So i finally found the problem.
I was calling another database so the php script couldn't fill in the good columns and was working without end

Thanks for this plugins

[exploit-soget]

I have a problem with this plugin.
I think i doesn't have understand how it works but i wish you can help me.
I have some servers in Cacti but in the syslogs plugin, i see only the syslog message of my local server.
Why i can't see the other server ?

I have installed Cacti with the last cactiEz cd and make some upgrade.

Some infos :

[root@cacti cacti]# ps -eaf | grep syslog
root 2519 1 0 Nov21 ? 00:00:00 /bin/bash /sbin/syslogtomysql
root 2523 2519 0 Nov21 ? 00:00:05 mysql -u cactiuser --password=x xxxxxxxxx syslog
root 2524 1 0 Nov21 ? 00:00:19 syslog-ng
root 4019 28398 0 17:18 pts/0 00:00:00 grep syslog

Cacti Version - 0.8.7a
Plugin Architecture - 1.4
Poller Type - Cactid v
Server Info - Linux 2.6.9-55.0.12.plus.c4smp
Web Server - Apache/2.0.59 (CentOS)
PHP - 5.1.6
PHP Extensions - libxml, xml, wddx, tokenizer, sysvshm, sysvsem, sysvmsg, standard, SimpleXML, sockets, SPL, shmop, session, Reflection, pspell, posix, mime_magic, iconv, hash, gmp, gettext, ftp, exif, date, curl, ctype, calendar, bz2, zlib, pcre, openssl, apache2handler, gd, mysql, mysqli, PDO, pdo_mysql, pdo_sqlite, snmp, eAccelerator
MySQL - 5.0.48
RRDTool - 1.2.23
SNMP - 5.1.2
Plugins

• Create Aggregate Graphs (aggregate - v0.63)
  Dataquery (dataquery - v0.1.4a)
  Network Discovery (discovery - v0.8.2)
  Error Images (errorimage - v0.1)
  FlowView (flowview - v0.4)
  Host Info (hostinfo - v0.2)
  killspike (killspike - v0.1.0a)
  Device Monitoring (monitor - v0.8.1)
  ReportIt (ReportIt - v0.5.1)
  RRD File Cleaner (RRD Cleaner - v0.32)
  Global Plugin Settings (settings - v0.3)
  SSL Redirector (ssl - v0.1)
  Syslog Monitoring (syslog - v0.5.1)
  Thresholds (thold - v0.3.
  Network Tools (tools - v0.2)
  Update Checker (update - v0.4)
  Real-time statistics (zond - v0.32)

[nahun]

Is your syslog-ng listening on a network interface? Maybe post your syslog-ng config

[cigamit]

Are your other servers set to send the syslogs to the Cacti server?

[exploit-soget]

I think my other servers was not set to send the syslogs to the Cacti server.
How can i do it ?

My syslog-ng.conf was in attachment.

[kurowsky]

If your other servers are also using syslog-ng you'll need another destination defining your remote syslog server and either include it in a current log statement or create another one. I just included it in a current one for the syslog messages.

Example: where x.x.x.x is the ip of your server

Code: Select all

destination df_server { udp("x.x.x.x" port(514));};

log {
        source(s_all);
        filter(f_syslog);
        destination(df_syslog);
        destination(df_server);
};

[r_chetanjain]

I am using the Syslog plugin from cactiusers.org...I am not able to view any messages in cacti...

Syslog-ng.conf
-----------------

options {
sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (no);
keep_hostname (yes);
};

#source s_sys {
# file ("/proc/kmsg" log_prefix("kernel: "));
# unix-stream ("/dev/log");
# internal();
# udp(ip(0.0.0.0) port(514));
# };

source net { udp(); };

destination d_mysql {
pipe("/var/log/mysql.pipe"
template("INSERT INTO syslog_incoming
(facility, priority, date, time, host, message, seq, status)
VALUES ( '$FACILITY', '$PRIORITY', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$HOST', '$MSG', '$SEQ', '$STATUS' );\n") template-escape(yes));
};

destination messages { file("/var/log/messages"); };
destination kern { file("/var/log/kern.log"); };


log { source(net); destination(d_mysql); };
--------------------------------------------------------------------------------
My script

#!/bin/bash

if [ -e /var/log/mysql.pipe ]; then
while [ -e /var/log/mysql.pipe ]
do
mysql -u syslog --password=cooler syslog < /var/log/mysql.pipe
done
else
mkfifo /var/log/mysql.pipe
fi

--------------------------------------------------------------------------------

Output of /var/log/mysql.pipe

INSERT INTO syslog_incoming
(facility, priority, date, time, host, message, seq, status)
VALUES ( 'local6', 'info', '2007-12-08', '12:10:47', '10.115.1.2', 'USER: admin logged in through telnet (10.4.114.16)', '', '' );
INSERT INTO syslog_incoming
(facility, priority, date, time, host, message, seq, status)
VALUES ( 'local6', 'info', '2007-12-08', '12:10:51', '10.115.1.2', 'SYST: 10.4.114.16 admin: clear counters', '', '' );
------------------------------------------------------------------------------

But i can't view any messages in Mysql andCacti... But when i just paste the Insert rule in Mysql manually with the same credentials, the table gets updates and i can see message in Cacti...

I think some issue with the PIPE...

Can you put some light


Chetan

[MatsB]

Just installed this great plugin. I got one problem though.
I get this error in Cacti:

Warning: mysql_pconnect() [function.mysql-pconnect]: Access denied for user 'haloe'@'localhost' (using password: YES) in /usr/share/php/adodb/drivers/adodb-mysql.inc.php on line 376

I've done all the steps as discribed in the readme file.
mysql -u root -p haloe
GRANT ALL ON haloe.* TO haloeuser@localhost IDENTIFIED BY 'mypassword';
GRANT ALL ON haloe.* TO cactiuser@localhost IDENTIFIED BY 'mypassword';
flush privileges;


Then I changed $haloedb_password in haloe-config.php to match the username and password from the previous step.

$haloedb_type = "mysql";
$haloedb_default = "haloe";
$haloedb_hostname = "localhost";
$haloedb_username = "haloe";
$haloedb_password = "mypassword";

[chrisgapske]

Maybe I am tired and sick but I think your problem is that you did this for

GRANT ALL ON haloe.* TO haloeuser@localhost IDENTIFIED BY 'mypassword';

When it should have been GRANT ALL ON haloe.* TO haloe@localhost IDENTIFIED BY 'mypassword';



Or Change your password config to look like this .
$haloedb_type = "mysql";
$haloedb_default = "haloe";
$haloedb_hostname = "localhost";
$haloedb_username = "haloeuser";
$haloedb_password = "mypassword";


It just looks like you got your username for the database wrong no worries.

Just installed this great plugin. I got one problem though.
I get this error in Cacti:

Warning: mysql_pconnect() [function.mysql-pconnect]: Access denied for user 'haloe'@'localhost' (using password: YES) in /usr/share/php/adodb/drivers/adodb-mysql.inc.php on line 376

I've done all the steps as discribed in the readme file.
mysql -u root -p haloe
GRANT ALL ON haloe.* TO haloeuser@localhost IDENTIFIED BY 'mypassword';
GRANT ALL ON haloe.* TO cactiuser@localhost IDENTIFIED BY 'mypassword';
flush privileges;


Then I changed $haloedb_password in haloe-config.php to match the username and password from the previous step.

$haloedb_type = "mysql";
$haloedb_default = "haloe";
$haloedb_hostname = "localhost";
$haloedb_username = "haloe";
$haloedb_password = "mypassword";

[MatsB]

Thx chrisgapske,

Must have been tiered to when I did this last night.

[spoonman]

Anyone using the 5.2 version of syslog and have added the line dividers between each entry? I see the code back on about page 9 but its for an earlier version of haloe... Code had changed alittle....Just curious if this is an interest to anyone else?? It seems very nice to me to have a line between each syslog message? Anyway if someone has it working can they post the code snipet?

Thanks

[nahun]

its been a while and I'm using 5.1, but I think it would be the same.

At line 229 on my syslog.php there is a foreach loop. All I added was the CSS to add border-bottom (I think at least, like I said it was a while ago). Here is what the loop looks like for me:

Code: Select all

foreach ($syslog_colors as $type => $color) {
		print ".syslog_$type, .syslog_$type td, .syslog_$type tr {\n";
		if ($color != '') {
			print "	background-color:	#$color;\n";
		}
		if (isset($syslog_text_colors[$type]) && $syslog_text_colors[$type] != '') {
			print "	color:		#" . $syslog_text_colors[$type] . ";\n";
		}
		print " border-bottom: 1px solid #000;\n";
		print "}\n";
	}

[pconrad]

When I change the syslog_text_color to anything other than "", the associated background color goes away.
This is not too big an issue until I use a darker color for the background. Black doesn't show up too well on blue.