syslog 1.22 cannot read syslog_incoming messages

[pixxxx]

Dear all I'm new to Cacti

syslog-ng is working correctly and messages are stored inside mysql db under syslog_incoming table
syslog for cacti is configured in order to read messages from cacti table

I don't know if it is correct but looking inside mysql schema I have seen the following:

1. I have two database, one named cacti another named syslog
2. syslog table structure is located on both databases
3. syslog_incoming table is filling only under syslog database

Installing syslog plugin no errors have been report but syslog section is empty

please help me to solve the issue

[francly]

Hi, I also having same problem, I can see the data in the mysql db but it's not show up on the cacti syslog menu, how to troubleshoot the problem.

I'm using 3.0.0-12-server, Cacti 0.8.7i and plugin syslog 1.22

Thanks.

[francly]

Anyone experience the same?

[francly]

I really can't figure out the problem, please give some hint to troubleshoot .

[francly]

Hi, I put all my configuration and setting below, if you find something wrong, please let me know, thanks.

config.php

<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2007 The Cacti Group |
| |
| This program is free software; you can redistribute it and/or |
| modify it under the terms of the GNU General Public License |
| as published by the Free Software Foundation; either version 2 |
| of the License, or (at your option) any later version. |
| |
| This program is distributed in the hope that it will be useful, |
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| GNU General Public License for more details. |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDTool-based Graphing Solution |
+-------------------------------------------------------------------------+
| This code is designed, written, and maintained by the Cacti Group. See |
| about.php and/or the AUTHORS file for specific developer information. |
+-------------------------------------------------------------------------+
| http://www.cacti.net/ |
+-------------------------------------------------------------------------+
*/

global $config, $database_type, $database_default, $database_hostname;
global $database_username, $database_password, $database_port;

/* revert if you dont use the Cacti database */
$use_cacti_db = false;

if (!$use_cacti_db) {
$syslogdb_type = 'mysql';
$syslogdb_default = 'syslog';
$syslogdb_hostname = 'localhost';
$syslogdb_username = 'root';
$syslogdb_password = 'xxxxxxxx';
$syslogdb_port = 3306;
}else{
$syslogdb_type = $database_type;
$syslogdb_default = $database_default;
$syslogdb_hostname = $database_hostname;
$syslogdb_username = $database_username;
$syslogdb_password = $database_password;
$syslogdb_port = $database_port;
}

/* field in the incomming table */
$syslog_incoming_config['dateField'] = 'date';
$syslog_incoming_config['timeField'] = 'time';
$syslog_incoming_config['priorityField'] = 'priority';
$syslog_incoming_config['facilityField'] = 'facility';
$syslog_incoming_config['hostField'] = 'host';
$syslog_incoming_config['textField'] = 'message';
$syslog_incoming_config['id'] = 'seq';

?>
config.php (END)

syslog-ng.conf

@version: 3.1
#Bare minimum syslog-ng configuration

options { long_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);
owner("root"); group("adm"); perm(0640); stats_freq(0);
bad_hostname("^gconfd$");
};

# we are using udp, and this is a collector for net traffic only
#
source s_all {
udp();
# internal();
# unix-stream("/dev/log");
# file("/proc/kmsg" log_prefix("kernel: "));
};

destination d_mysql {
sql(type(mysql)
host("localhost") username("root") password("xxxxxxxx")
database("syslog")
table("syslog_incoming")
columns("facility", "priority", "date", "time", "host", "message")
values("$FACILITY", "$PRIORITY", "$YEAR-$MONTH-$DAY", "$HOUR:$MIN:$SEC", "$HOST_FROM", "$MSG")
indexes("facility", "priority", "date", "time", "host", "msg"));
};

log {
source(s_all);
destination(d_mysql);
};

Database



Syslog setting



Syslog menu

[francly]

anyone can help, much appreciate.

[XTech]

Everything looks good, but seems like Cacti can't fetch values from syslog_incoming table.
Is anything about syslog in Cacti logfile?

[francly]

Everything looks good, but seems like Cacti can't fetch values from syslog_incoming table.
Is anything about syslog in Cacti logfile?

Thanks for response, nothing related "syslog" keyword on the log file.

[XTech]

Very interesting. I've a lot of SYSLOG statistics messages.
Problem with syslog plugin install maybe? Looks like poller isn't executing syslog_process.php
Try to do this manually.

Code: Select all

php <cacti dir>/plugins/syslog/syslog_process.php --debug

clipbrd01.png (151.26 KiB) Viewed 10399 times

[francly]

XTech, you are absolutely right, after execute the given command, I got an output and the syslog message appear on the gui, everything just work, many thanks.

Now how come my poller is not run automatically? Can you give advice how to fix this?

[XTech]

I think here is a problem with syslog plugin install. I'm not familiar enough with cacti plugin architecture, but there is table plugin_hooks in cacti database which contains (in my installation) following data:

clipbrd01.png (12.76 KiB) Viewed 10396 times

According to Cacti Plugin Architecture API string with id=97 here describes a hook between main poller and syslog_poller.

[francly]

I have compare your table value and it's exactly same what I have, could this be a problem?

[francly]

How to make sure the syslog poller process run automatically?

[XTech]

Sorry for very long timeout in my replies.
Run command:

Code: Select all

php <cacti dir>/poller.php --debug --force

There are lots of debug output, so redirect it to some file. Look for strings like:

Code: Select all

06/14/2012 02:24:55 PM - POLLER: Poller[0] DEBUG: About to Spawn a Remote Process [CMD: /usr/bin/php, ARGS: -q /var/www/cacti/plugins/mactrack/poller_mactrack.php]
06/14/2012 02:24:55 PM - POLLER: Poller[0] DEBUG: About to Spawn a Remote Process [CMD: /usr/bin/php, ARGS:  -q /var/www/cacti/plugins/syslog/syslog_process.php]
06/14/2012 02:24:55 PM - POLLER: Poller[0] DEBUG: About to Spawn a Remote Process [CMD: /usr/bin/php, ARGS:  -q /var/www/cacti/plugins/rrdclean/rrdmove.php]

In my output here are strings for mactrack, rrdclean and syslog plugins.

[francly]

I got a different result, what is that mean?

[snip]
Waiting on 1 of 1 pollers.
Waiting on 1 of 1 pollers.
Waiting on 1 of 1 pollers
[snip]
Waiting on 1 of 1 pollers.
Waiting on 1 of 1 pollers.
Waiting on 1 of 1 pollers.
Waiting on 1 of 1 pollers.
Waiting on 1 of 1 pollers.
Waiting on 1 of 1 pollers.
06/14/2012 09:55:50 PM - SYSTEM STATS: Time:221.4571 Method:cmd.php Processes:1 Threads:N/A Hosts:198 HostsPerProcess:198 DataSources:14250 RRDsProcessed:5435
Loop Time is: 221.46
Sleep Time is: 78.54
Total Time is: 221.46
PHP Fatal error: Cannot redeclare png2jpeg() (previously declared in /var/www/cacti/plugins/thold/thold_functions.php:3028) in /var/www/cacti/plugins/nectar/nectar_functions.php on line 557