syslog plugin - no INFO file

[hillda01]

Hi,

I'm running Cacti Version 1.1.38 on Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-43-generic x86_64)

I'm trying to load the syslog plugin so I can get logs from my Cisco devices.

I've tried to install syslog-v1.22-2.tgz from https://docs.cacti.net/plugin:syslog

I untar the file with tar -xzvf and then copied the folder and contents to /usr/share/cacti/site/plugins

From within Cacti webinterface - it says there is no INFO file and sure enough there isn't - how can I get the INFO file or create one that has the right contents or is there a different version of the plugin I can get which is compatible with my variation of Cacti and Ubuntu.

Regards,

Dave.

[camerabob]

The versions posted on the Cacti site are legacy for the 0.8.8x branch. Go here for the 1.x version: https://github.com/Cacti/plugin_syslog

[hillda01]

Thanks for the reply!

I’ll give that a go and reply back...

Regards,

Dave.

[hillda01]

I tried that plugin and now I get the message

Syslog Monitoring Not Compatible, Requires: Cacti >= 1.2.0 The Cacti Group 2.2

[camerabob]

Try this

[hillda01]

That seems to be getting me further than before - I've got the plugin installed....

How do I then add a Cisco switch to push it logs to the syslog plugin to my Cacti server....

[camerabob]

You're on your own here. I never finished setting up my syslog server and associated polling/logging.

[hillda01]

OK - thanks....

I'll let you know how I get on...

It should be fairly straightforward - you'd think.

[hillda01]

Hi,

I’ve configured my Cisco switch to forward the logs to my Cacti server.

My Cacti server doesn’t seem to be listening on port 514

Has anyone else configured the syslog plugin and made the necessary configuration adjustments.

Regards,

Dave.

[netniV]

You need to have configured rsyslog as well as the cacti syslog plugin. I do believe that's documented in the installation instructions.

[hillda01]

I must say so far it's been a really painful exercise trying to get syslog into Cacti... surely it shouldn't be this hard.

I've Googled a lot about setting up Syslog and I've got it logging to a .log file but I haven't a clue how to connect that to the Cacti Webinterface….

Has anyone created an "idiots guide" to setting up Syslog inconjunction with the syslog plugin?

Regards,

Dave.

[netniV]

The problem is there are many moving parts to getting syslog working. You need a syslog daemon to receive the data, then inject that into the MySQL database, you also need to have the syslog plugin, configured and enabled so that it's poller takes the incoming messages and injects them into the main tables based off the rules that you have defined.

The syslog plugin also allows you to use a different database for its data than cacti itself because of the amount that get inserted to ensure that the core database doesn't become sluggish because of it.

So, the better bet is to try and post where you know you've managed to get up to and what problem you are having. The basics are

• Do you have a syslog daemon listening on 514
• Do you have the daemon processing those messages and injecting them into the syslog's syslog_incoming table (I think that's the name)
• Do you have the poller processing syslog messages via the poller_syslog.php/ (should happen if the plugin is enabled)
• Do you have any rules in place that may block the messages being processed?
• Have you enabled debugging for the plugin?

[hillda01]

I've done the following pretty much in this order.

1. Installed Ubuntu 18.04
2. Performed the updates
3. Installed Cacti
4. Added devices for bandwidth monitoring via snmp
5. Installed the syslog plugin (and done basic configuration to log into the cacti db - possibly not the best option given there could be lots of syslogs)
6. Followed a guide to configure syslog - https://kifarunix.com/how-to-configure- ... ntu-18-04/
7. I can see that I'm getting logs to /var/log/devicename/xxxx.log

[netniV]

Then you need to follow the reset of the syslog setup, you have nothing that's injecting the data into the incoming messages table using the configuration on that linked page.

[hillda01]

Do you mean reset the syslog plugin configuration?

How do I go about that ?