Syslog problem

General discussion about Plugins for Cacti

Moderators: Developers, Moderators

Post Reply
Lud3rik
Posts: 5
Joined: Thu Aug 27, 2015 3:42 am

Syslog problem

Post by Lud3rik »

Hello,

My problem is that when I go to the web interface of syslog plugin, I don't see any logs.

Context :

I have installed the syslog plugin an I've chosen to redirect logs into a separate dababase.
Distro : CentOS 7
Database : MariaDB

When I do the following :

use syslog;
select * from syslog_incoming;

I see rows.

Here is my config files :

1°) /etc/rsyslog.conf

$ModLoad ommysql
$template cacti_syslog,"INSERT INTO syslog_incoming(host, facility, priority, date, time, message) values ('%HOSTNAME%', '%syslogfacility-text%', '%sysnlogpriority-text%', '%timereported:::date-rfc3339%', '%timereported:::date-mysql%', '%msg%')",SQL
*.* >localhost,syslog,cactiuser,password;cacti_syslog

2°) /usr/share/cacti/plugins/syslog/config.php

/* revert if you dont use the Cacti database */
$use_cacti_db = false;

if (!$use_cacti_db) {
$syslogdb_type = 'mysql';
$syslogdb_default = 'syslog';
$syslogdb_hostname = 'localhost';
$syslogdb_username = 'cactiuser';
$syslogdb_password = 'password';
$syslogdb_port = 3306;
}else{
$syslogdb_type = 'mysql';
$syslogdb_default = 'syslog';
$syslogdb_hostname = 'localhost';
$syslogdb_username = 'cactiuser';
$syslogdb_password = 'password';
$syslogdb_port = 3306;

Thank you for your help :)
Last edited by Lud3rik on Sat Aug 29, 2015 9:05 am, edited 1 time in total.
cigamit
Developer
Posts: 3368
Joined: Thu Apr 07, 2005 3:29 pm
Location: B/CS Texas
Contact:

Re: Syslog problem

Post by cigamit »

Check your syslog_incoming table and see if there is anything there. If not, then you have a whole lot of things you will need to test, like firewall, selinux, etc...
Lud3rik
Posts: 5
Joined: Thu Aug 27, 2015 3:42 am

Re: Syslog problem

Post by Lud3rik »

Hello cigamit and thank you for your reply.

I do see rows into the syslog_incoming table. The problem is that these rows are not appearing in the web interface of cacti anf I don't know why.

PS : SE Linux is disabled
cigamit
Developer
Posts: 3368
Joined: Thu Apr 07, 2005 3:29 pm
Location: B/CS Texas
Contact:

Re: Syslog problem

Post by cigamit »

Try going into the syslog directory, and running from the command line

Code: Select all

php syslog_process.php -d
Lud3rik
Posts: 5
Joined: Thu Aug 27, 2015 3:42 am

Re: Syslog problem

Post by Lud3rik »

I have done this and I saw a lot of errors.
I have decided to completely delete cacti, and I am trying to make a Kibana syslog server, which I hope will be more powerfull than syslog plugin.
archen
Posts: 5
Joined: Mon Oct 05, 2015 8:48 am

Re: Syslog problem

Post by archen »

Hello,

I have a very similar problem: Cacti Version 0.8.8b, installed from ubuntu repository, syslog plugin version 1.22, rsyslog 7.4.4.
The rsyslog tables are within the cacti database.

I see nothing on the syslog dashboard but the syslog_incoming table is being populated.
If I run /usr/bin/php /usr/share/cacti/site/plugins/syslog/syslog_process.php --debug as root or as www-data I see

Code: Select all

SYSLOG: Syslog Table IS Partitioned
SYSLOG: Unique ID = 113
SYSLOG: Found   0,  New Message(s) to process
SYSLOG: Stats   20,  Record(s) to the 'syslog_statistics' table
SYSLOG: Found   0,  Removal Rule(s) to process
SYSLOG: Found   0,  Alert Rules to process
SYSLOG: Moved   48,  Message(s) to the 'syslog' table
SYSLOG: Deleted 48,  Already Processed Message(s) from incoming
SYSLOG: Deleted 0,  Syslog Statistics Record(s)
SYSLOG: Deleted 0,  Syslog alarm log Record(s)
SYSLOG: Processing Reports...
SYSLOG: We have 0 Reports in the database
SYSLOG: Finished processing Reports...
10/05/2015 03:44:09 PM - SYSTEM SYSLOG STATS:Time:0.18 Deletes:0 Incoming:0 Removes:0 XFers:48 Alerts:0 Alarms:0 Reports:0
and I can see the old logs on the cacti dashboard, but they are not updated anymore, even if I refresh the page, unless I issue the command again.

All the files in the cacti dir are now owned by www-data, which is the user that starts the apache2 service.

every 5 minutes I also see in my cacti log

Code: Select all

10/05/2015 04:00:02 PM - CMDPHP: Poller[0] ERROR: SQL Assoc Failed!, Error:'1054', SQL:"SELECT * FROM `cacti`.`syslog_remove` WHERE enabled='on'"
10/05/2015 04:00:02 PM - CMDPHP: Poller[0] ERROR: SQL Assoc Failed!, Error:'1054', SQL:"SELECT * FROM `cacti`.`syslog_alert` WHERE enabled='on'"
10/05/2015 04:00:02 PM - SYSTEM SYSLOG STATS:Time:0.11 Deletes:0 Incoming:0 Removes:0 XFers:41 Alerts:0 Alarms:0 Reports:0
I'm not sure it is related, but looking at the table names...

Please let me know if there is any detail that I can provide.
Thank you very much and best regards
archen
Posts: 5
Joined: Mon Oct 05, 2015 8:48 am

Re: Syslog problem

Post by archen »

Hi,

there is no any idea about this problem?

Thank you very much and best regards
Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest