Syslog Doesn't Send Emails Alerts

[Mood977]

Hello All,

I'm facing an issue with my Syslog as it stopped sending emails as usual, sometimes I receive mails maybe once per month or so.

I've tried the "Send a Test Email" option, and I can receive the test mail immediately, so that means the communication between the Syslog and the SMTP is fine.

Also, I've captured all traffic coming to the Syslog from the client devices and I could see alerts coming to the syslog bur no emails sent.

Could anyone help me identify the problem in order to solve it, and if there is any tables should be cleared and how to do that.

The Cacti version is 0.8.8b.

Thanks,
Sobhy

[Osiris]

Check the size of your syslog_incoming table. Sometimes older versions of syslog get stuck due to too much data.

[Mood977]

Hello Osiris,

Thanks for your feedback, could you tell me where to check this table and how to clear its data ?

[Osiris]

mysql -A cacti
selelct count(*) from syslog_incoming;
quit;

[Mood977]

Here is the output.

mysql> select count(*) from syslog_incoming;
+----------+
| count(*) |
+----------+
| 44803 |
+----------+
1 row in set (0.00 sec)

Note that I used Navicat app to log into the DB and deleted roughly half of them and the issue still exists.
Another thing to mention is all records I found in this table belonged to an old day (17-05-2017), below is the mysql output after removing the records.

mysql> select count(*) from syslog_incoming;
+----------+
| count(*) |
+----------+
| 23000 |
+----------+
1 row in set (0.00 sec)

Is there any service should be reloaded or what should I do ?

Thanks,

[Osiris]

Use this command ' truncate table syslog_incoming' and see if that fixes it.

[Mood977]

Hello Osiris,

First of all, I really appreciate your help.

I've just did truncate the table, and I'll monitor the situation, but thanks to check below steps I've done earlier today.

Actually I don't know what the below command means, just found it in the commands history and executed it.

[root@localhost ~]# mysql -u cactiuser -p cacti < syslog_alert.sql
Enter password:
[root@localhost ~]#

Also, I've executed the below one and noticed that the syslog_logs table took the whole time checking and maybe repairing; it took around 1:15 hour.

[root@localhost ~]# mysqlcheck -uroot -p --auto-repair --databases syslog
Enter password:
syslog.syslog OK
syslog.syslog_alert OK
syslog.syslog_facilities OK
syslog.syslog_host_facilities OK
syslog.syslog_hosts OK
syslog.syslog_incoming OK
syslog.syslog_logs OK ------------------> Took around 1:15 Hour to get the OK
syslog.syslog_priorities OK
syslog.syslog_remove OK
syslog.syslog_removed OK
syslog.syslog_reports OK
syslog.syslog_statistics OK
[root@localhost ~]#

Here is a GUI snap of logs for only one day.

Logs.PNG (21.21 KiB) Viewed 2468 times

Adding that found only 6362 inside this table!

mysql> select count(*) from syslog_logs;
+----------+
| count(*) |
+----------+
| 6362 |
+----------+
1 row in set (0.00 sec)

Regards,

[Osiris]

How many row in the syslog_logs table? You might want to have that table purge from time to time if it's real big. Also, what is the storage engine?

show table status like 'syslog_logs'\G

That command should get you what you are looking for.

[Mood977]

I need to mention that the incoming table is still 0 rows since I truncate it, is that normal ??

The storage of the server is as below:

[root@localhost ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root
95G 19G 72G 21% /
tmpfs 1.9G 0 1.9G 0% /dev/shm
/dev/sda1 477M 70M 382M 16% /boot
/dev/mapper/VolGroup-lv_home
46G 4.8G 39G 11% /home
[root@localhost ~]#

And the table status before removing all rows is as below.

mysql> show table status like 'syslog_logs'\G
*************************** 1. row ***************************
Name: syslog_logs
Engine: MyISAM
Version: 10
Row_format: Dynamic
Rows: 15697
Avg_row_length: 1510
Data_length: 14580232284
Max_data_length: 281474976710655
Index_length: 826431488
Data_free: 14556517596
Auto_increment: 288231049
Create_time: 2014-02-07 17:55:12
Update_time: 2020-03-14 12:37:06
Check_time: 2020-03-13 22:29:57
Collation: latin1_swedish_ci
Checksum: NULL
Create_options:
Comment:
1 row in set (0.00 sec)

mysql>

[Osiris]

You should be all set now.

[Mood977]

Unfortunately, the issue still there but I have created a new alert for a log continuously coming and the result is I can receive this alert but maybe each hour or so.

I've monitored the Syslogs tap in the GUI and found that every around 30 : 50 minutes I receive bunch of logs which now for sure will include the mentioned above log, so I receive an email for it. And other logs which don't show in the Syslogs tap don't receive emails for them, that explains why I see logs from time to time!

I've truncate the syslog table and restarted mostly all services (ntpd, httpd, snmpd, postfix, crond, mysqld, and rsyslog) and still facing the same issue.

[Osiris]

What Cacti version in case you did not mention it before?

[Mood977]

It is 0.8.8b

[Osiris]

Yea, really old. You should consider upgrading.