CaMM (Cacti Message Management) plugin v1.6.7 2010-08-26

[cruxx]

Does the rules (Overall Trigger) working correcly? Try to set the "Debug mode" in the section Cacti settings (camm) and see the output in the cacti.log.
Does other rules (e.g. mark) working correctly?

greetings,
cruxx

[computer_guru]

I enabled camm debug to the cacti log, it logged just fine, but did not give me any help. I forced a rule to run and I got a weird error, but the email showed up, then no other emails from CAMM. Then I went through more logs and poked around linux, ran the camm_poller.php manually, etc..

nothing helped. Then all of a sudden, the emails started working again. So the problem is gone. Weird?

[lasylve]

Gthe, Are you dead ???

As I needed it, I brought some extra feature on this plugin to keep non-important traps in an history.

I can now display active traps in the original tab,

ack01.jpg (26.88 KiB) Viewed 6177 times

I can "ack" them manually

ack02.jpg (39.52 KiB) Viewed 6177 times

or by a rule which executes a "User function" that I created.

ack03.jpg (37.97 KiB) Viewed 6177 times

and they go in a "Traps History" tab which displays the name of the user who acked the trap (if a trap has been acked by a rule, you can see "(r)" before the name)

ack04.jpg (35.1 KiB) Viewed 6177 times

I was wondering if someone else was interested by this feature.

Gthe, if you see this post, can you contact me ????

[mpdsville1]

@lasylve ..
I am very much interested in seeing ack_traps and trap_history added to CAMM..
It will extremely well for Network Operations Center type folks.

Suggestions:
- The new feature should be enabled/disabled via radio buttons in the
admin interface similar to snmptt and syslog so it doesn't disrupt any
established workflows. (who knows what proceedures others use)
- UnAck: Toggle between Ack and UnAck. depending on the state of
"AckNess". (Accidents happen)
- The "Ack/UnAck" should be a permission granted on a per user basis:
User-->Realm Permissions -- > Plugin -> camm: Ack/UnAck

All in all I'd love to see this functionality

[lasylve]

I forgot to mention it but, off course you can unAck traps

ack05.jpg (26.18 KiB) Viewed 6174 times

Then, there's already a kind of "permission system" in camm : only users with "Plugin -> camm: Manage" option can delete traps, so I did the same for ack / unack function => users with only "Plugin -> camm: View" activated can not ack/unack traps.

ack06.jpg (7.06 KiB) Viewed 6174 times

For the last part (enable/disable the function), it should be possible but I don't get your last sentence :

- The new feature should be enabled/disabled via radio buttons in the
admin interface similar to snmptt and syslog so it doesn't disrupt any
established workflows. (who knows what proceedures others use)

Now, I have been trying to contact the plugin author (Gthe) for months in order to know if he wants to include this feature in a future release, I can share my version but I can not ensure that it would be compatible with a likely update made by Gthe (indeed, it would just be deleting a column in "plugin_camm_traps" table, so it should work)

Regards

[mpdsville1]

Ref: My last sentence .

- The new feature should be enabled/disabled via radio buttons in the
admin interface similar to snmptt and syslog so it doesn't disrupt any
established workflows. (who knows what proceedures others use)

I was trying to suggest that for those that dont want to use the Traps_history
function it should be disable-able similar to "Use SNMPTT" and "Use SYSLOG" under:
Cacti--> CAMM->Settings & Utils->Settings -> CaMM Components
or perhaps under
Cacti--> CAMM->Settings & Utils->Settings -> CaMM SNMPTT Settings
Some network op managers may not wish to have the second pane visible or use it at all.
Theres no guarantee that everybody wants to ack a trap. I do, but some wont want to.
Really promising work !

[stextor]

I've gotten pretty far with the CAMM plugin. Thanks guys. Now my problem is that I can't run the /sbin/syslogtomysql script because it will constantly import the /tmp/mysql.pipe file into the cacti database with redundant information. If I run the commands seperately it works:

mysql -u root cacti < /tmp/mysql.pipe # the data is imported and shows up in my CAMM tab. But then I HAVE to clear out the mysql.pipe file. If I don't, running the mysql -u root cacti < /tmp/mysql.pipe command again takes what was in the mysql.pipe file and any newly added syslog entries and imports them again into my cacti database / plugin_camm_syslog table.

If I call the /sbin/syslogtomysql script from the /etc/init.d/syslog-ng script the syslog-ng service never really startsup correctly (seems to hang) and I still have the problem of having to clear out the /tmp/mysql.pipe file before I import in my plugin_camm_syslog table/

Anyone have any ideas that will let me clear out the mysql.pipe file or at least finish importing the data from the mysql.pipe file, deleted it and then recreate it so more syslogs can be written into it. I will then use cron to schedule a import / file clean every 5 minutes.

[stextor]

OK.. I figured it out. First of all I'm running a Centos 5.6 server all patched up, Cacti 8.7g PIA 2.9 (all patched up) with the following relavent plugins installed:
- settings 0.7
- Camm 1.6.7 (I followed the regular installations instructions here, but I did not install the syslog plugin)

Using yum, I installed eventlog 0.2.7, eventlog-devel 0.2.7 and eventlog-static 0.2.7. (I don't think I really needed to install eventlog-static but what the heck:)
[root@lab ~]#yum install eventlog eventlog-devel eventlog-static

I can't remember now but I think when I compiled syslog-ng 3.2.2 it complained about not seeing eventlog, hence I installed it as stated above.

I wish I could have used yum for the installation of syslog-ng verion 3.2.2 but yum wanted to install version 2.?.? and that was the verison where I had to use the piping feature and I had to run the syslogtomysql shell script, which gave me the problems stated above.

I then downloaded, compiled and installed syslog-ng ver 3.2.2. Making sure the ./configure command output reads that you have SQL support available before you run 'make'. I compiled it with the ./configure --sysconfdir=/etc/syslog-ng/ option so that my syslog-ng.conf file is located where I am used to it being. The ./configure command automatically found MySQL and enabled the integration feature (the configure command will, by default, try to find mySQL). If not I think the option to enable it is --enable-sql (you can read the configure file with gedit or whatever to find out the 'Optional Features'). Simply open the configure file and search for --enable keyword until you find the 'Optional Features' section. So if you want to insure sql support and where you put your conf file, here are the commands to compile syslog-ng 3.2.2

[root@lab ~]#./configure --enable-sql --sysconfdir=/etc/syslog-ng/


## read the output for errors and warnings and rerun configure after you figure out how to get rid of the errors or warnings (I will not elaborate on this becuase you can be chasing your tail here compiling and installing tons of dependencies) But, none-the-less, you will most likely have to fix all of the error messages and evaluate if you need to fix the warnings or not. ##

Then run..
[root@lab ~]#make (again read / fix errors)

then run ..

[root@lab ~]#make install (and read / make note of its output for bin, lib and conf file locations)

After ./configure , make and make install, Here is the output from a syslog-ng -V command:

[root@lab ~]# syslog-ng -V
syslog-ng 3.2.2
Installer-Version: 3.2.2
Revision: ssh+git://bazsi@git.balabit//var/scm/gi ... 3.2#master#1d3f396485eb47b1ff6aa18ac4f1c4cd51c0ea4c
Compile-Date: Apr 20 2011 12:40:44
Enable-Threads: on
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-Sun-STREAMS: off
Enable-IPv6: on
Enable-Spoof-Source: off
Enable-TCP-Wrapper: on
Enable-SSL: on
Enable-SQL: on
Enable-Linux-Caps: on
Enable-Pcre: off
Enable-Pacct: off


Here is my new syslog-ng.conf file:

#############################################################################
# Default syslog-ng.conf file which collects all local logs into a
# single file called /var/log/messages.
#

@version: 3.2
@include "scl.conf"

source s_local {
system();
internal();
};

source s_network {
udp();
};

destination d_local {
file("/var/log/messages");
};

log {
source(s_local);

# uncomment this line to open port 514 to receive messages
#source(s_network);
destination(d_local);
};

## Log to Mysql for Php-syslog-ng

## I commented out the two lines below because my init.d script was complaining about them so I got rid of them:)
#source s_everything { internal(); pipe("/proc/kmsg");
#unix-stream("/dev/log"); udp(); };


source net {
udp();
};

destination d_mysql {
program("/usr/bin/mysql -u root cacti"
template("INSERT INTO plugin_camm_syslog (host, sourceip, facility, priority, sys_date, message, status)
VALUES ( '$HOST', '$SOURCEIP', '$FACILITY', '$PRIORITY', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$MSG', '0' );\n")
template-escape(yes));
};

log { source(net); destination(d_mysql); };
log { source(s_local); destination(d_mysql); };


########################

Since this is a lab environment I run mysql as root and now password. If you have a different userID and password then cahnge the command in blue above to:

program("/usr/bin/mysql -u whomever -p whatever_password whichever_cactidb"

Here is the relavent parts of the OLD syslog-ng.conf file (notice the pipe("/tmp/mysql.pipe) line has been replace with the program("/usr/bin/mysql -u root cacti" line. It was this line that allowed me to not use the piping file feature that was exhibiting the above behaviour as mention in my original post.

########################

source net {
udp();
};
destination d_mysql {
pipe("/tmp/mysql.pipe)
template("INSERT INTO plugin_camm_syslog (host, sourceip, facility, priority, sys_date, message, status) VALUES ( '$HOST', '$SOURCEIP', '$FACILITY', '$PRIORITY', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$MSG', '0' );\n")
template-escape(yes)
);
};

log { source(net); destination(d_mysql); };
log { source(s_sys); destination(d_mysql); };

########################

I placed this init script into the /ect/init.d/ directory


######################

#!/bin/bash
#
# syslog-ng This starts and stops syslog-ng
#
# chkconfig: 2345 12 88
# description: syslog-ng is an alternative system logger
# processname: syslog-ng
# pidfile: /var/run/syslog-ng.pid
### BEGIN INIT INFO
# Provides: $syslog-ng
### END INIT INFO

# Source function library.
. /etc/init.d/functions

binary="/sbin/syslog-ng"

[ -x $binary ] || exit 0

RETVAL=0

start() {
echo -n "Starting syslog-ng: "
daemon $binary
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/syslog-ng
}

stop() {
echo -n "Shutting down syslog-ng: "
killproc syslog-ng
RETVAL=$?
echo
if [ $RETVAL -eq 0 ]; then
rm -f /var/lock/subsys/syslog-ng
rm -f /var/run/syslog-ng.pid
fi
}

restart() {
echo -n "Restarting syslog-ng: "
$binary --syntax-only
RETVAL=$?
echo
if [ $RETVAL -eq 0 ]; then
stop
sleep 2
start
fi
}

reload() {
echo -n "Reloading syslog-ng: "
$binary --syntax-only
RETVAL=$?
if [ $RETVAL -eq 0 ]; then
killproc syslog-ng -1
fi
}

case "$1" in
start)
start
;;
stop)
stop
;;
status)
status syslog-ng
;;
restart)
restart
;;
reload)
reload
;;
condrestart)
[ -f /var/lock/subsys/syslog-ng ] && restart
;;
*)
echo "Usage: $0 {start|stop|status|restart|reload|condrestart}"
;;
esac

##########################

I think the example init script supplied had my bin file referenced in the wrong place so I changed it. (referenced in blue above)

Then I made it executable
[root@lab ~]#chmod +x /etc/init.d/syslog-ng

Added it as a service
[root@lab ~]#chkconfig --add syslog-ng
Turned it on
[root@lab ~]#chkconfig syslog-ng on
And restarted it for good measure
[root@lab ~]#/etc/init.d/syslog-ng restart

We run Cisco IOS here so I sent syslogs to the lab cacti instance simply by typing in:

switch-xyz(config)# logging 172.20.xxx.xx (the lab cacti instance ip address)


I then waited a five or ten minutes and syslog events started showing under my Camm tab.

Hope this helps. Happy Easter !!

P.S. I would have posted a pic of my Camm Tab screenshot but I would have to spend a lot of time anonymizing it (did I spell that right?) and it's lunch time. But I can elaborate more if needed.

[smlick]

I have some problem with CAMM plugin (1.6.6) with rule.....I'm not able to create new one.
In clog I get this error:
04/29/2011 09:17:26 PM - CMDPHP: Poller[0] ERROR: SQL Row Failed!, Error:'145', SQL:"SELECT * FROM `plugin_camm_tree2` where `id` = '0';"
04/29/2011 09:17:26 PM - CMDPHP: Poller[0] ERROR: SQL Cell Failed!, Error:'145', SQL:"SELECT sum(`dev_count`) FROM `plugin_camm_tree2` WHERE `_is_device`='1' AND `type`='syslog' and `period`='all' and `_is_marker`=0 ;"
04/29/2011 09:16:45 PM - CMDPHP: Poller[0] ERROR: A DB Exec Failed!, Error:'1366', SQL:"INSERT INTO `plugin_camm_rule` SET `rule_type`='syslog', `notes`='Rule was auto create based on syslog message', `json_filter`='{"fieldId":"host","operatorId":"STRING_EQUAL","values":[{"label":"RISYS001RM01","value":"RISYS001RM01"}]}', `sql_filter`='host=\'RISYS001RM01\'', `is_delete`='1', `is_email`='0', `is_function`='0', `is_mark`='0', `name`='RISYS001RM01', `order`='2', `rule_enable`='1', `email`='', `sup_mode`='', `email_message`='', `marker`='', `marker_name`='', `date`='2011-04-29T21:16:43', `user_id`='1' '

So I disabled, uninstalled, removed camm folder from plugin, copied the new camm 1.6.7 folder into plugin, installed from plugin managemant and enabled but when the db update I get 3 error (see the image).

What goes wrong??? So the problem is not with camm but with the db? Any idea?

Regards
Alessio

[gthe]

mysql error 145 - This is usually a sign of a corrupted table.

[smlick]

I checked the table also with extended option and they seems ok

P.S.: is normal that???
mysql> use cacti
Database changed
mysql> SELECT * FROM `plugin_camm_tree2` where `id` = '0';
Empty set (0.00 sec)

Regards
Alessio

[smlick]

The plugin_camm_syslog_incoming table inside cacti db doesn't exist, and also if I uninstall and reinstall the plugin the table is not created.
Why?

Regards
Alessio

[gthe]

The plugin_camm_syslog_incoming table inside cacti db doesn't exist, and also if I uninstall and reinstall the plugin the table is not created.
Why?

Regards
Alessio

Any error in debug log ?

[smlick]

This is one of some more errors that are visible into the log:

05/03/2011 06:04:09 PM - CMDPHP: Poller[0] ERROR: A DB Exec Failed!, Error:'1364', SQL:"INSERT INTO `plugin_camm_tree2` (`device_id`,`description`, `hostname`,`gr_f`,`gr_v`,`agentip`,`agentip_source` ,`type` ,`period`,`_is_type`,`_is_device`,`_parent` ,`count` ,`dev_count` ,`online` ,`_is_leaf`,`_lvl`) SELECT `t0`.`device_id`,`t0`.`description`,`t0`.`hostname`,`t0`.`gr_f`,`t0`.`gr_v`,`t0`.`agentip`,`t0`.`agentip_source`,'syslog',`t0`.`period` ,'0' ,'0' ,t1.id ,t0.`count` ,`t0`.`dev_count`,'1' ,'1' ,'5' FROM plugin_camm_temp as t0 join plugin_camm_tree2 as t1 on (t0.type=t1.type and t0.hostname=t1.hostname and t0.period=t1.period and t0.gr_f=t1.gr_f) WHERE `t0`.`type`='syslog' and `t1`.`online`='1' and `_is_marker`='0' group by hostname,period,`t0`.gr_f,gr_v ON DUPLICATE KEY UPDATE `plugin_camm_tree2`.`dev_count` = values(`dev_count`), `plugin_camm_tree2`.`_parent` = values(`_parent`), `plugin_camm_tree2`.`count` = values(`count`), `plugin_camm_tree2`.`online` = '1' ;'
05/03/2011 06:04:09 PM - CMDPHP: Poller[0] ERROR: A DB Exec Failed!, Error:'1364', SQL:"INSERT INTO `plugin_camm_tree2` (`device_id`,`description`, `hostname`,`gr_f`,`gr_v`,`agentip`,`agentip_source` ,`type` ,`period`,`_is_type`,`_is_device`,`_parent` ,`count` ,`dev_count` ,`online` ,`_is_leaf`,`_lvl`) SELECT `t0`.`device_id`,`t0`.`description`,`t0`.`hostname`,`t0`.`gr_f`,`t0`.`gr_v`,`t0`.`agentip`,`t0`.`agentip_source`,'syslog',`t0`.`period` ,'0' ,'0' ,t1.id ,t0.`count` ,`t0`.`dev_count`,'1' ,'0' ,'4' FROM plugin_camm_temp as t0 join plugin_camm_tree2 as t1 on (t0.type=t1.type and t0.hostname=t1.hostname and t0.period=t1.period) WHERE `t0`.`type`='syslog' and `t1`.`online`='1' and `_is_marker`='0' group by hostname,period,gr_f ON DUPLICATE KEY UPDATE `plugin_camm_tree2`.`dev_count` = values(`dev_count`), `plugin_camm_tree2`.`_parent` = values(`_parent`), `plugin_camm_tree2`.`count` = values(`count`), `plugin_camm_tree2`.`online` = '1' ;'

As I wrote I tried also to remove and reinstall the plugin but nothing changed!!!!! When I tried to reinstall as you can see in the image I get 3 errors.

Any idea??
Thank you

Alessio

[gthe]

Run one of this sql (from log) in mysql command line to see full error info.