Syslog 1.21 Issues

[mjf]

I just installed Syslog 1.21, and it seems to be working mostly ok.

It appears though that the Priority drop down does not work. Only "All Priorities" seems to work. All others show no records.

Also, are the messages supposed to be color coded by priority? Mine all appear in the same color (Notice) regardless of priority.

I am running Cacti 0.8.7g and PIA 2.8 on Ubuntu 10.04.

Thanks.

[mjf]

After a little digging it appears this problem may be related to the fact that the messages are coming in with numeric priorities, instead of text ones. So instead of coming in with "Notice", the message just has a "6". I see these additional numeric priorities in the "syslog_priorities" table with their own id.

I am not sure how to cross reference or convert these numeric codes to their matching text code. Any suggestions would be appreciated.

[mjf]

Also, while poking around, I can't seem to get the SQL Expression to work on the Removal page. I get this message in the Cacti log:

CMDPHP: Poller[0] ERROR: A DB Exec Failed!, Error:'1064', SQL:"DELETE FROM `cacti`.`syslog_incoming` WHERE message (select message from cacti.syslog_incoming where message = '') AND status='19''

I am attempting to remove blank syslog messages.

If I run the same query only as a SELECT statement against the "syslog" table, I get the same error. If I change part of the query from "WHERE message (..." to "WHERE message IN (..." it seems to work.

It could also be that I am not formatting my removal statement correctly. I cannot seem to find any documentation or other forum posts that show how to format the SQL Expression.

[mjf]

Well, I think I solved the first problem anyway. I changed the INSERT command on the cacti_syslog template in the rsyslog config. I changed %syslogpriority% to '%syslogpriority-text%'. The single quotes are significant. The messages are now coming in with text priorities, and the highlighting and priority drop down are now working.

Thanks for listening.

[classen]

Thanks for the tip.

I was not having much luck figuring out how to convert teh numerical priority levels back to text.... then I found your post.

It seems that for every 100 questions asked on this board 2 get answers from other people. Most are answered by the OP (if answered at all).
I think this is because cacti is not used my 100s of thousands of people so teh forum traffic is low, and those that are the experts are busy monitoring their own systems, doing their jobs, developing new features for Cacti, etc.

Anyways I found this useful.

Cheers

[TheWitness]

Classen,

Cacti is Open Source software. The OP's (or Mods) have full time jobs, and most users are technical enough not to have to ask questions about something as simple as what can easily be found in the manual rsyslog. It appears that you are not one of those users and to boot, have a very poor attitude.

TheWitness

[classen]

It appears that you are not one of those users and to boot, have a very poor attitude.

Well my intention wasn't to disrespect the creators and/or maintainers of cacti. I think Im pretty technially adept, and i am a big fan of RTFM. I was merely trying to bump this post so that others might see it. My comments on the helpfulness or frequency of forum posts and the solutions found therein probably stemmed from my being stumped on some particular cacti issue. I was trying to stimulate others to post solutions and help one another. Many of the questions asked on the forum are beyond my ability to answer, but whenever possible I try to post my solutions or answer others questions.

[TheWitness]

It appears that you are not one of those users and to boot, have a very poor attitude.

Well my intention wasn't to disrespect the creators and/or maintainers of cacti. I think Im pretty technially adept, and i am a big fan of RTFM. I was merely trying to bump this post so that others might see it. My comments on the helpfulness or frequency of forum posts and the solutions found therein probably stemmed from my being stumped on some particular cacti issue. I was trying to stimulate others to post solutions and help one another. Many of the questions asked on the forum are beyond my ability to answer, but whenever possible I try to post my solutions or answer others questions.

I'll try to be more positive in the future. I hope you do the same.

[007san]

I added some code in plugins/syslog/syslog_process.php to update id to TEXT.

original code

Code: Select all

/* flag all records with the uniqueID prior to moving */

Added Code

Code: Select all

syslog_db_execute("UPDATE `syslog_incoming` SET `syslog_incoming`.`priority` = ( SELECT `syslog_priorities`.`priority`
FROM `syslog_priorities` WHERE `syslog_incoming`.`priority` = `syslog_priorities`.`priority_id` )
WHERE EXISTS ( SELECT `syslog_priorities`.`priority` FROM `syslog_priorities`
WHERE `syslog_incoming`.`priority` = `syslog_priorities`.`priority_id` )");


syslog_db_execute("UPDATE `syslog_incoming` SET `syslog_incoming`.`facility` = ( SELECT `syslog_facilities`.`facility`
FROM `syslog_facilities` WHERE `syslog_incoming`.`facility` = `syslog_facilities`.`facility_id` )
WHERE EXISTS ( SELECT `syslog_facilities`.`facility` FROM `syslog_facilities`
WHERE `syslog_incoming`.`facility` = `syslog_facilities`.`facility_id` )");

original code

Code: Select all

syslog_db_execute("UPDATE `" . $syslogdb_default . "`.`syslog_incoming` SET status=" . $uniqueID . " WHERE status=0");

[TheWitness]

You should not be modifying the syslog plugin, but rather the syslog-ng/rsyslog configuration.