Syslog monitor addon beta

[nahun]

But my syslog-ng delivers the data in the logs table. I can see the data but can't uses the alerts or removals part. I am able fill these in but nothing seems to happen.

so your syslogs get a little farther than mine. But the same thing happens with the alerts and removals part.

[spoonman]

Guys..........i'have a question about this syslog plugin. I dont have any other sys logging set up ? I've installed the syslog plugin but What else do I need to get logs?? I dont really see anywhere to add a device or host that could send the logs to me?? I've seen others talking about syslog-ng or something, is that something else I need??

THX

[nahun]

You need to setup a mysql database so that a sysloging program can insert the syslogs into the database. Syslog-ng is a good and popular program, I would use that if you're just starting. All the plugin for cacti does is display the syslogs from the database, it doesn't do any storage or anything. The newest version alerts on and deletes syslogs, but I haven't gotten it to work yet.

Here is a good how-to: http://vermeer.org/docs/1

One I've used also: http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG

But I would use the first one more.

If you're using linux, I can maybe help more. But I haven't done any syslogs with windows.

[spoonman]

Thx nahun - yea Im using Linux. I've already got the database created and the plugin working........I just didnt see anywhere to add stuff???? Let me look at those links.

Thanks.

[twelzy]

Which table:

mysql -u XXXX --password=XXXXX syslog < /var/log/mysql.pipe

or

mysql -u XXXX --password=XXXXX syslog_incoming < /var/log/mysql.pipe
?!?!?!


Thanks in advance!
(...and sorry for my poor English!)

[nahun]

Which table:

mysql -u XXXX --password=XXXXX syslog < /var/log/mysql.pipe

or

mysql -u XXXX --password=XXXXX syslog_incoming < /var/log/mysql.pipe

syslog_incoming. I'm 90% sure. lol

[twelzy]

I decided to log to a file all PHP`s errors:

Code: Select all

[14-Mar-2006 00:14:57] PHP Warning:  Invalid argument supplied for foreach() in /opt/cacti/plugins/haloe/setup.php on line 70

Following, a small part of my unchanged "/opt/cacti/plugins/haloe/setup.php":

Code: Select all

68  if ($sql != '') {
69          $at = db_fetch_assoc($sql);
70          foreach ($at as $a) {
71                  $alertm .= "<table cellpadding=1 cellspacing=0 border=0 bgcolor='#000000' width=500><tr><td><table width='100%' cellpadding=1 cellspacing=0 border=0 bgcolor='#FFFFFF'>\n";
72                  $alertm .= '<tr bgcolor="#dedede"><td>Hostname</td><td>: ' . $a['host'] . "</td></tr>\n";
73                  $alertm .= '<tr bgcolor="#dedede"><td>Date</td><td>: ' . $a['date'] . ' ' . $a['time'] . "</td></tr>\n";
74                  $alertm .= '<tr bgcolor="#dedede"><td>Severity</td><td>: ' . $a['priority'] . "</td></tr>\n";
75                  $alertm .= '<tr bgcolor="#000000"><td colspan=2 height=1>' . "</td></tr>\n";
76                  $alertm .= '<tr><td colspan=2>' . $a['message'] . "\n</td></tr>";
77                  $alertm .= "</table></td></tr></table><br><br>\n";
78          }
79  }

... and no e-mail message is sent!

Anybody has any idea of what is causing this problem?


Thanks in advance!
(...and sorry for my poor English!)

[spoonman]

Guys......I think i've got syslog-ng possibly configured right ... I just got it to create the mysql.log file.......but here is what's inside......

Can't locate DBI.pm in @INC (@INC contains: /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl .) at /usr/local/mysql/bin/mysqlhotcopy line 8.
BEGIN failed--compilation aborted at /usr/local/mysql/bin/mysqlhotcopy line 8.



Any ideas????

Haven't gotten any local logs to input into mysql db yet.

[nahun]

Any ideas????

Haven't gotten any local logs to input into mysql db yet.

Could you post your syslog-ng.conf file?

And maybe to make sure you're getting incoming syslogs do a 'tcpdump port 514' or whatever your syslog port is.

[flavour]

Can't locate DBI.pm in @INC (@INC contains: /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl .) at /usr/local/mysql/bin/mysqlhotcopy line 8.
BEGIN failed--compilation aborted at /usr/local/mysql/bin/mysqlhotcopy line 8.

Need to install the DBI perl module:
http://search.cpan.org/~timb/DBI-1.50/DBI.pm
http://www.rcbowen.com/imho/perl/modules.html

F

[Viggy]

I have to ask a stupid question

Running the following
0.8.6g
Kiwi Syslog
plugin 0.1.2

I have the plugin installed. Syslog data is being displayed inside cacti.

Where is the Alerting and Removal people are talking about? I don't see this option on my screens.

[nahun]

I have to ask a stupid question

Running the following
0.8.6g
Kiwi Syslog
plugin 0.1.2

I have the plugin installed. Syslog data is being displayed inside cacti.

Where is the Alerting and Removal people are talking about? I don't see this option on my screens.

Thats an old version of the plugin. http://cactiusers.org/ has 0.2

[tgk]

I had the same problem as nahun. The syslog plugin worked fine except for the removals/emails. I found in the cacti log that it was trying to use a column named "message", even when my message column is called "msg", and defined as such in the syslog config file.

Code: Select all

$haloe_config["textField"]       = "msg"; 

... In the cacti.log:

Code: Select all

CMDPHP: Poller[0] ERROR: SQL Exec Failed "delete from syslog_incoming where message like '*******%'"

It seems the plugin has the column name "message" hardcoded. The easy solution is to change your syslog tables to use message instead of msg, and change the plugin config file and syslog-ng config (or whatever syslogger you are using) accordingly.

BTW, the haloe_remove.php file from the plugin has a typo in the first few lines. It reads:

Code: Select all

if (isset($_PSOT['id']))
	$id = $_POST['id'];

... it should be _POST instead of _PSOT

[nahun]

I had the same problem as nahun. The syslog plugin worked fine except for the removals/emails. I found in the cacti log that it was trying to use a column named "message", even when my message column is called "msg", and defined as such in the syslog config file.

well actually, I couldn't get the syslogs to go from the syslog_incoming table to the syslog table. I got this error:

Code: Select all

02/22/2006 08:50:47 PM - CMDPHP: Poller[0] ERROR: SQL Exec Failed "UPDATE syslog_incoming set status=1"

But my syslog-ng is using "msg" too, so I'll try changing it to "message" sometime and fix that typo.

Thankst tgk

[mgb]

@nahun,

I had the same problem as you did

ERROR: SQL Assoc Failed

but after changing msg to message and changing PSOT to POST the faultmessage from the cacti log disapeared and the remove seems to work. Maybe time for a 0.3 version?
Looks like it's working for me.