syslog plugin database schema

[secrookie]

Does this plugin use a standard syslog-ng mysql data schema?

I already have a syslog-ng mysql database setup which I am using with php-syslog-ng. I would like to utlize this database with the cacti syslog plugin.

I followed the syslog walkthru - http://forums.cacti.net/viewtopic.php?t=26040 but cannot see any events and get the following error:

Code: Select all

Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /usr/share/cacti/plugins/syslog/functions.php on line 190

I am using the database name/user/password correct.

thanks
secrookie

[secrookie]

The table I need and the schema appers be the same. not sure why I am encountering that error though.. must be missing something...

-my current syslog-ng mysql database
mysql> show tables;
+------------------+
| Tables_in_syslog |
+------------------+
| actions |
| all_logs |
| cemdb |
| logs |
| logs20080425 |
| search_cache |
| user_access |
| users |
+------------------+
11 rows in set (0.00 sec)

mysql> show columns from logs;
+----------+---------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+----------+---------------------+------+-----+---------+----------------+
| host | varchar(128) | YES | MUL | NULL | |
| facility | varchar(10) | YES | MUL | NULL | |
| priority | varchar(10) | YES | MUL | NULL | |
| level | varchar(10) | YES | | NULL | |
| tag | varchar(10) | YES | | NULL | |
| datetime | datetime | YES | MUL | NULL | |
| program | varchar(15) | YES | MUL | NULL | |
| msg | text | YES | | NULL | |
| seq | bigint(20) unsigned | NO | PRI | NULL | auto_increment |
+----------+---------------------+------+-----+---------+----------------+
9 rows in set (0.00 sec)

[TheWitness]

Syslog must be setup to your table schema. You need to edit the config.php in the syslog plugin directory to properly align tables names. Your table names are different than what the plugin expects. In addition, the syslog plugin assumes an "incoming" table. I do not see one, but I assume you know what that table is.

Other than that, do a "show create table logs" and let's make sure it is optimized. Show us the results.

TheWitness

[secrookie]

Just compared config.php syslog fields with my current mysql database fields.

'syslog_incoming' appears to be equivalent to 'logs' (in my db),
'date' & 'time' fields are split whereas in mine its 'datetime'. Not sure on the other 4 tables.

Here show 'create table logs' as requested:

Code: Select all

+-------+-------------------------------+
| Table | Create Table                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
+-------+---------------------------------------+
| logs  | CREATE TABLE `logs` (
  `host` varchar(128) default NULL,
  `facility` varchar(10) default NULL,
  `priority` varchar(10) default NULL,
  `level` varchar(10) default NULL,
  `tag` varchar(10) default NULL,
  `datetime` datetime default NULL,
  `program` varchar(15) default NULL,
  `msg` text,
  `seq` bigint(20) unsigned NOT NULL auto_increment,
  PRIMARY KEY  (`seq`),
  KEY `host` (`host`),
  KEY `program` (`program`),
  KEY `datetime` (`datetime`),
  KEY `priority` (`priority`),
  KEY `facility` (`facility`)
) ENGINE=MyISAM AUTO_INCREMENT=31031 DEFAULT CHARSET=latin1 | 
+-------+--------------------------------------------+
1 row in set (0.00 sec)

regards
secrookie

[TheWitness]

That's likely a problem. You should change your syslog-ng config file to split them using Jimmy's example. Do it in the database as well. Then make sure your config file is consistent with your schema.

You might simply want to update your syslog-ng config to one that matches what syslog is expecting though.

TheWitness

[joez]

I followed the HOWTO and posted some notes.

I see the GUI now when clicking on syslog-tab, but nothing gets imported to my database (syslog_incoming is empty). Could you tell me how to find out what the problem is?

Thanks
joez

[davidvd]

I have the exact same problem.

Please, help us!

[cigamit]

Is your syslog-ng set to push the events into the syslog_incoming table?