Syslog (syslog-ng.conf) example

[itkroplis]

Hi!

After CACTI update from 0.8x to 1.1.7 version (Debian8+MySql 5.5.54), Not work syslog-ng rightly, Not show syslog message in webpage, but show Syslog Message Filter [ Start: '2017-06-02 05:39' to End: '2017-06-04 05:39', Unprocessed Messages: 3
After test syslog sending (udp:514)

My syslog-ng.conf :
@version: 3.1
#Bare minimum syslog-ng configuration

options { long_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);
owner("root"); group("adm"); perm(0640); stats_freq(0);
bad_hostname("^gconfd$");
};

# we are using udp, and this is a collector for net traffic only
#
source s_all {
udp();
# internal();
# unix-stream("/dev/log");
# file("/proc/kmsg" log_prefix("kernel: "));
};

destination d_mysql {
sql(type(mysql)
host("localhost") username("root") password("password")
database("syslog")
table("syslog_incoming")
columns("facility", "priority", "date", "time", "host", "message")
values("$FACILITY", "$PRIORITY", "$YEAR-$MONTH-$DAY", "$HOUR:$MIN:$SEC", "$HOST_FROM", "$MSG")
indexes("facility", "priority", "date", "time", "host", "msg"));
};

log {
source(s_all);
destination(d_mysql);
};


Maybe for problem resolved need changes in syslog-ng.conf ?
Please show my, full working syslog-ng.conf for cacti 1.1.7+ Mysql

[XforceTR69]

try this

destination d_mysql {
sql(type(mysql)
host("localhost") username("root") password("password")
database("cactidb") table("syslog_incoming")
columns("facility_id", "priority_id", "program", "date", "time", "host", "message")
values("$FACILITY_NUM","$LEVEL_NUM","$PROGRAM","$YEAR-$MONTH-$DAY","$HOUR:$MIN:$SEC","$HOST","MSGONLY"));
};

if it doesnt work with your syslog db create a cactidb database like in the example

[itkroplis]

No, not work
I reinstall syslog plugin, and recreate syslog DB + import tables from syslog.sql

How to work syslog chain.
syslog-ng listen UDP:514, if recives syslog message, It send their to MySQL db syslog table ''syslog_incomming"

Whats happens next? Whats processing next? syslog plugins .PHP files or DB?