Rsyslog with Syslog plugin

[stevo300]

Hello,

I have managed to configure my RSyslog to put data into the syslog_incoming table.

However nothing appears in the syslog table and nothing shows up from within the plugin.

this is my rsyslog.conf

Code: Select all

#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#                       For more information see
#                       /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html


$ModLoad ommysql.so
$template cacti_syslog,"INSERT INTO syslog_incoming(facility, priority, date, time, host, message) values (%syslogfacility%, %syslogpriority%,  '%timereported:::date-mysql%', '%timereported:::date-mysql%', $
*.* >localhost,syslog,cacti,password;cacti_syslog

*.* :ommysql:localhost,syslog,cacti,password


#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$WorkDirectory /rsyslog/work  # default location for work (spool) files

#$ActionQueueType LinkedList   # use asynchronous processing
#$ActionQueueFileName srvrfwd  # set file name, also enables disk mode
#$ActionResumeRetryCount -1    # infinite retries on insert failure
#$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
#*.*       @@server:port


$ModLoad imklog   # provides kernel logging support
$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

syslog/config.php

Code: Select all

/* revert if you dont use the Cacti database */
$use_cacti_db = false;

if (!$use_cacti_db) {
        $syslogdb_type     = 'mysql';
        $syslogdb_default  = 'syslog';
        $syslogdb_hostname = 'localhost';
        $syslogdb_username = 'cacti';
        $syslogdb_password = 'password';
        $syslogdb_port     = 3306;
}else{
        $syslogdb_type     = $database_type;
        $syslogdb_default  = $database_default;
        $syslogdb_hostname = $database_hostname;
        $syslogdb_username = $database_username;
        $syslogdb_password = $database_password;
        $syslogdb_port     = $database_port;
}

any help would be appreciated

[Linegod]

This line doesn't look right: "*.* >localhost,syslog,cacti,password;cacti_syslog"

I would suggest debugging rsyslog:

Code: Select all

rsyslogd -f /path/to/rsyslog.conf -N1

[stevo300]

rsyslogd: version 5.8.11, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: WARNING: rsyslogd is running in compatibility mode. Automatically generated config directives may interfer with your rsyslog.conf settings. We suggest upgrading your config and adding -c5 as the first rsyslogd option.
rsyslogd: bind: Permission denied
rsyslogd: No UDP listen socket could successfully be initialized, message reception via UDP disabled.

rsyslogd: Could not open output pipe '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad immark
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: MarkMessagePeriod 1200
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad imuxsock
rsyslogd: End of config validation run. Bye.


This is the output from that command
I have tried to put the '-c5' into the conf file but didn't change anything

[Linegod]

The '-c5' is an unrelated error. It looks like rsyslog is either still running, or you are attempting to run it as a user, not root.

[stevo300]

I performed the command again with sudo

sudo rsyslogd -f /etc/rsyslog.conf -N1
rsyslogd: version 5.8.11, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: WARNING: rsyslogd is running in compatibility mode. Automatically generated config directives may interfer with your rsyslog.conf settings. We suggest upgrading your config and adding -c5 as the first rsyslogd option.
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad immark
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: MarkMessagePeriod 1200
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad imuxsock
rsyslogd: End of config validation run. Bye.

however I still cannot get any logs to show in the plugin but the syslog_incoming table is filling nicely

[Linegod]

but the syslog_incoming table is filling nicely

Previously it wasn't, correct?

[stevo300]

No, it was filling but nothing was coming through to the plugin...

However I had to rebuild from scratch last night due a corrupt disk. And all is now working as expected. Thanks for your assistance it is greatly appreciated.

[mozolins]

Looks like your rsyslog.conf mysql module is missing some characterss.

try this one:

$ModLoad MySQL

$template cacti_syslog,"INSERT INTO syslog_incoming(facility, priority, date, time, host, message) values (%syslogfacility%, %syslogpriority%, '%timereported:::date-mysql%', '%timereported:::date-mysql%', '%HOSTNAME%', '%msg%')", SQL

*.* >localhost,cacti,cacti,<passwd>;cacti_syslog

[trungmv]

Hi all,

I have same problem. Already posting here: http://forums.cacti.net/viewtopic.php?f ... og#p240240

If i change

Looks like your rsyslog.conf mysql module is missing some characterss.

try this one:

$ModLoad MySQL

$template cacti_syslog,"INSERT INTO syslog_incoming(facility, priority, date, time, host, message) values (%syslogfacility%, %syslogpriority%, '%timereported:::date-mysql%', '%timereported:::date-mysql%', '%HOSTNAME%', '%msg%')", SQL

*.* >localhost,cacti,cacti,<passwd>;cacti_syslog

And restart rsyslog, still display

Code: Select all

db error (1045): Access denied for user 'cactiuser'@'localhost' (using password: YES)

Any help is appreciated,

Regards,