Syslog monitor addon beta

[cigamit]

Thanks a lot for the wonderful plugin. I upgraded v1.1b to 1.2b to enable 'putput to file' but it is still not functioning. Whenever I do it, it outputs an empty file. Is 'output to file' bug still pending ?


Thanks!!!

Alex

I've fixed it in my plugin version a while back, I'll post the minor changes below.

in functions.php Change this function

Code: Select all

function export () {

	global $haloe_config;

	header("Content-type: text/plain");
	header("Content-Disposition: attachment; filename=log_view-" . date("Y-m-d",time()) . ".log");
	$haloe_messages = get_haloe_messages();

	if (sizeof($haloe_messages) > 0) {
		foreach ($haloe_messages as $haloe_message) {
			print $haloe_message[$haloe_config["hostField"]] . "," . $haloe_message[$haloe_config["facilityField"]] . "," . $haloe_message[$haloe_config["priorityField"]] . "," . $haloe_message[$haloe_config["dateField"]] . "," . $haloe_message[$haloe_config["timeField"]] . "," . $haloe_message[$haloe_config["textField"]] . "\r\n";
		}
	}

}

to include these 2 extra lines after the Header calls.

Code: Select all

	include('plugins/haloe/config.php');
	db_connect_real($haloedb_hostname,$haloedb_username,$haloedb_password,$haloedb_default, $haloedb_type);

so in the end, it will look like this

Code: Select all

function export () {

	global $haloe_config;

	header("Content-type: text/plain");
	header("Content-Disposition: attachment; filename=log_view-" . date("Y-m-d",time()) . ".log");
	include('plugins/haloe/config.php');
	db_connect_real($haloedb_hostname,$haloedb_username,$haloedb_password,$haloedb_default, $haloedb_type);
	$haloe_messages = get_haloe_messages();

	if (sizeof($haloe_messages) > 0) {
		foreach ($haloe_messages as $haloe_message) {
			print $haloe_message[$haloe_config["hostField"]] . "," . $haloe_message[$haloe_config["facilityField"]] . "," . $haloe_message[$haloe_config["priorityField"]] . "," . $haloe_message[$haloe_config["dateField"]] . "," . $haloe_message[$haloe_config["timeField"]] . "," . $haloe_message[$haloe_config["textField"]] . "\r\n";
		}
	}

}

and now you should have a working export. This is assuming you are using the Plugin version, if not you will have to change the include to this instead

Code: Select all

include('./include/haloe-config.php');

[AlexK]

Wow, thanks for the prompt reply. Since I am not using a plugin, I did it exactly as you've instructed for non-plugin environment. My end-result modified section for haloe_functions.php looks like this:

function export () {

global $haloe_config;

header("Content-type: text/plain");
header("Content-Disposition: attachment; filename=log_view-" . date("Y-m-d",time()) . ".log");
include('../include/haloe-config.php');
db_connect_real($haloedb_hostname,$haloedb_username,$haloedb_password,$haloedb_default, $haloedb_type);

$haloe_messages = get_haloe_messages();

if (sizeof($haloe_messages) > 0) {
foreach ($haloe_messages as $haloe_message) {
print $haloe_message[$haloe_config["hostField"]] . "," . $haloe_message[$haloe_config["facilityField"]] . "," . $haloe_message[$haloe_config["priorityField"]] . "," . $haloe_message[$haloe_config["dateField"]] . "," . $haloe_message[$haloe_config["timeField"]] . "," . $haloe_message[$haloe_config["textField"]] . "\r\n";
}
}

}


But what I am getting right now is the following output in an output file:

<br>Cannot connect to MySQL server on ''. Please make sure you have specified a valid MySQL database name in 'include/config.php'.

For some reason it is referencing include/config.php instead of include/haloe-config.php. What file should I modify to rectify the problem ?

Thanks a metric ton!!

Alex

[AlexK]

Oh, by the way, screen output works like a charm, it's just output to file function is not functioning. It looks like database.php file is outputing an error.

Thanks!!!

Alex

[cigamit]

Oh, by the way, screen output works like a charm, it's just output to file function is not functioning. It looks like database.php file is outputing an error.

Thanks!!!

Alex

Hum... going over the code, I see that the author actually has a db connection started now (didn't in the old one). Without more testing I can't say for sure why its not working as it should. I am currently using the "old" version with alot of custom work done to it, so I can't just upgrade and test it. I will see about getting a test machine running it and will debug from there.

[harlequin]

Oh, by the way, screen output works like a charm, it's just output to file function is not functioning. It looks like database.php file is outputing an error.Thanks!!!
Alex

I am just now seeing that the zip file I posted for 1.2b had an old version in it as well? I'm a schmuck
Please re-download & re-install (sorry) and let me know if that fixes it.
Thanks,
Harlequin

[farhan]

Hi harlequin,

When are you going to release new version of his plugin. I have been

waiting anxiously. How about the restrict users to view only specific host

syslogs?

[harlequin]

Hi harlequin,
When are you going to release new version of his plugin. I have been
waiting anxiously. How about the restrict users to view only specific host
syslogs?

Hi farhan,
No date as of yet - work has been pretty busy lately, so I haven't had much opportunity to play with h.aloe. I am still working on it whenever I get the chance, though. I'll keep you posted, hope to have something soon...
Harlequin

[AlexK]

Awsome! It worked. Thanks! The only thing I had to do in my linux box
was to change priority levels to the following:

From This:

"Emergency" => array('color' => "FF0000", 'level' => 0, ),
"Critical" => array('color' => "FF0000", 'level' => 1, ),
"Alert" => array('color' => "FF0000", 'level' => 2, ),
"Error" => array('color' => "FFAB00", 'level' => 3, ),
"Warning" => array('color' => "FFFF00", 'level' => 4, ),
"Notice" => array('color' => "99FFCC", 'level' => 5, ),
"Info" => array('color' => "default", 'level' => 6, ),
"Debug" => array('color' => "D0D0D0", 'level' => 7, ),


To This:
"emerg" => array('color' => "FF0000", 'level' => 0, ),
"crit" => array('color' => "FF0000", 'level' => 1, ),
"alert" => array('color' => "FF0000", 'level' => 2, ),
"err" => array('color' => "FFAB00", 'level' => 3, ),
"warning" => array('color' => "FFFF00", 'level' => 4, ),
"notice" => array('color' => "99FFCC", 'level' => 5, ),
"info" => array('color' => "default", 'level' => 6, ),
"debug" => array('color' => "D0D0D0", 'level' => 7, ),

Thanks!!!

Alex

[tman]

Just tried adding this to a Win2k3 Cacti server running 0.8.6h. Added the plugin ok, but when I click on the Syslogs tab I get;

Warning: mysql_pconnect(): Access denied for user 'haloe'@'localhost' (using password: YES) in C:\Inetpub\wwwroot\cacti\lib\adodb\drivers\adodb-mysql.inc.php on line 355

I assume I'm meant to modify the haloe config.php to reflect the correct username and db, but I'm just curious as to whether haloe should use it's own MySql database (haloedb_default) or whether all the data should be dumped into the cactidb.

Cheers

[cigamit]

Just tried adding this to a Win2k3 Cacti server running 0.8.6h. Added the plugin ok, but when I click on the Syslogs tab I get;

Warning: mysql_pconnect(): Access denied for user 'haloe'@'localhost' (using password: YES) in C:\Inetpub\wwwroot\cacti\lib\adodb\drivers\adodb-mysql.inc.php on line 355

I assume I'm meant to modify the haloe config.php to reflect the correct username and db, but I'm just curious as to whether haloe should use it's own MySql database (haloedb_default) or whether all the data should be dumped into the cactidb.

Cheers

You can add it to the cacti database, but the plugin was made to use its work either way, as some people had the syslog database setup way before they even started using Cacti (like me). It also helps to seperate the data incase of a DB crash (as it has done to me before). In my setup, I am are dealing with millions of syslog records, which queries to can bring any server to a crawl, and sometimes it just decide to die on ya (mysql isn't the best at large databases)

[berndog46]

Great Add-on!

We're having an issue where the value in the "Level" field is always prefixed by the facility value (e.g. Level7.Warning). I assume that this is because this is how the value is received in the original syslog message, both internally and from external devices. Obviously, this causes issues with filtering, coloring, etc. because various facility values are being used from different client devices.

Has anyone else dealt with this issue in the past? Can anyone point us in the right direction in terms of how to remove this text from the Level field so that we are only left with the actual level text? As far as I know, there is no way to exclude this from the originating (i.e. client) device. Any help would be appreciated.

[aLTeReGo]

I'm working under the assumption that we are each allowed one stupid question per thread, so here is mine.

It appears (though I might be mistaken) that MySQL or any ODBC database support in Kiwi is a pay for option only. Do you have any free windows syslog services that meet the requirements for this plugin?

[Pumpi]

Problem adding syslog.sql to haloe database (using plugin):

I use command mysql haloe < syslog.sql after I have created the dabase haloe but I get following error:

ERROR 1064 at line 5: You have an error in your SQL Syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'collate_latin1_general_ci default NULL, priority varchar(10)

I'm running MySQL server version 4.0.18 on aSUSE Enterprise Server 9.

[TheWitness]

Pumpi,

It looks like cigamit has moved to MySQL 5.x which includes the default character set in hte dump syntax which is not well supported in MySQL 4.x.

TheWitness

[mgb]

Did a minor change to syslog which could be easy implemented.
I wanted to display the number of entry's per ip in the syslog database in order to see problems on certain switches or routers faster.

Changed some code in haloe.php

Replace this part

$hosts = db_fetch_assoc("SELECT DISTINCT " . $haloe_config["hostField"] . " FROM " . $haloe_config["haloeTable"] . " ORDER BY " . $haloe_config["hostField"] . " ASC");
if (sizeof($hosts) > 0) {
foreach ($hosts as $host) {
print "<option value=" . $host[$haloe_config["hostField"]];
foreach ($_REQUEST["host"] as $rh) {
if ($rh == $host[$haloe_config["hostField"]]) {
print " selected ";
break;
}
}
print ">";
print $host[$haloe_config["hostField"]] . "</option>\n";


with this part

$hosts = db_fetch_assoc("SELECT DISTINCT " . $haloe_config["hostField"] . ", COUNT(" . $haloe_config["hostField"] . ") AS ItemCount FROM " . $haloe_config["haloeTable"] . " GROUP BY " . $haloe_config["hostField"] ." ORDER BY ItemCount DESC");
if (sizeof($hosts) > 0) {
foreach ($hosts as $host) {
print "<option value=" . $host[$haloe_config["hostField"]];
foreach ($_REQUEST["host"] as $rh) {
if ($rh == $host[$haloe_config["hostField"]]) {
print " selected ";
break;
}
}
print ">";

$hostip=$host[$haloe_config["hostField"]];
for ($n=strlen($hostip);$n < 20;$n++)
$hostip=$hostip . "&nbsp;";

print $hostip . $host["ItemCount"] . "</option>\n";


Hope someone can use this

Michael