Syslog Plugin and External RSyslog Problem

[Wizzer]

There is no data in the Syslog tab. The Syslog plugin is installed and my Rsyslog is on a different server. Config.php is configured for an external syslog server and devices are logging to the Rsyslog server. The events on the Rsyslog server are being moved from syslog_incoming table to the syslog table by the cacti server. As a test I put some data in the Cacti syslog table and it was displayed in the Syslog tab.

It looks like Cacti is looking at the Cacti syslog table instead of the remote Rsyslog syslog table. I think this is the root of my problem.

As another test, I changed the name of the Cacti syslog table and received the following errors in the Cacti Log:

09/10/2010 02:57:09 PM - CMDPHP: Poller[0] ERROR: SQL Cell Failed!, Error:'1146', SQL:"SELECT SUM(totals) FROM ( SELECT count(*) AS totals FROM `cacti`.`syslog` WHERE logtime BETWEEN '2010-09-09 14:57' AND '2010-09-10 14:57' UNION SELECT count(*) AS totals FROM `cacti`.`syslog_removed` WHERE logtime BETWEEN '2010-09-09 14:57' AND '2010-09-10 14:57') AS rowcount"
09/10/2010 02:57:09 PM - CMDPHP: Poller[0] ERROR: SQL Assoc Failed!, Error:'1146', SQL:"(SELECT *, 'main' AS mtype FROM `cacti`.`syslog` WHERE logtime BETWEEN '2010-09-09 14:57' AND '2010-09-10 14:57' ) UNION (SELECT *, 'remove' AS mtype FROM `cacti`.`syslog_removed` WHERE logtime BETWEEN '2010-09-09 14:57' AND '2010-09-10 14:57') ORDER BY logtime DESC LIMIT 0,30"
09/10/2010 02:57:05 PM - CMDPHP: Poller[0] ERROR: SQL Cell Failed!, Error:'1146', SQL:"SELECT SUM(totals) FROM ( SELECT count(*) AS totals FROM `cacti`.`syslog` WHERE logtime BETWEEN '2010-09-09 14:57' AND '2010-09-10 14:57' UNION SELECT count(*) AS totals FROM `cacti`.`syslog_removed` WHERE logtime BETWEEN '2010-09-09 14:57' AND '2010-09-10 14:57') AS rowcount"
09/10/2010 02:57:05 PM - CMDPHP: Poller[0] ERROR: SQL Assoc Failed!, Error:'1146', SQL:"(SELECT *, 'main' AS mtype FROM `cacti`.`syslog` WHERE logtime BETWEEN '2010-09-09 14:57' AND '2010-09-10 14:57' ) UNION (SELECT *, 'remove' AS mtype FROM `cacti`.`syslog_removed` WHERE logtime BETWEEN '2010-09-09 14:57' AND '2010-09-10 14:57') ORDER BY logtime DESC LIMIT 0,30"

Should the syslog tables (syslog_incoming, syslog, etc.) be on the Cacti server if I'm using an external sysylog server?

What needs to be changed to point the syslog plugin to the external syslog server?

Wizzer

[TheWitness]

You need to follow the instructions and make sure that if you are using an external database, that it is all setup properly in config.php (syslog's).

TheWitness