Syslog monitor addon beta

General discussion about Plugins for Cacti

Moderators: Developers, Moderators

Post Reply
User avatar
nahun
Cacti User
Posts: 92
Joined: Wed Feb 15, 2006 11:27 pm
Location: Idaho
Contact:

Post by nahun »

mgb wrote:But my syslog-ng delivers the data in the logs table. I can see the data but can't uses the alerts or removals part. I am able fill these in but nothing seems to happen.
so your syslogs get a little farther than mine. But the same thing happens with the alerts and removals part.
[size=75]Solaris 10 x86 [color=red][b]||[/b][/color] Cacti - 0.8.7 [color=red][b]||[/b][/color] MySQL - 5.0.45 [color=red][b]||[/b][/color] PHP - 5.2.6 [color=red][b]||[/b][/color] RRDTool - 1.2.23 [color=red][b]||[/b][/color] NET-SNMP - 5.4.1 [color=red][b]||[/b][/color] Syslog-ng 2.0.5
[url=http://www.indigo-networks.com]indigo-networks.com[/url][/size]
spoonman
Cacti User
Posts: 305
Joined: Tue May 03, 2005 8:54 am
Location: GA

Post by spoonman »

Guys..........i'have a question about this syslog plugin. I dont have any other sys logging set up ? I've installed the syslog plugin but What else do I need to get logs?? I dont really see anywhere to add a device or host that could send the logs to me?? I've seen others talking about syslog-ng or something, is that something else I need??

THX
User avatar
nahun
Cacti User
Posts: 92
Joined: Wed Feb 15, 2006 11:27 pm
Location: Idaho
Contact:

Post by nahun »

You need to setup a mysql database so that a sysloging program can insert the syslogs into the database. Syslog-ng is a good and popular program, I would use that if you're just starting. All the plugin for cacti does is display the syslogs from the database, it doesn't do any storage or anything. The newest version alerts on and deletes syslogs, but I haven't gotten it to work yet.

Here is a good how-to: http://vermeer.org/docs/1

One I've used also: http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG

But I would use the first one more.

If you're using linux, I can maybe help more. But I haven't done any syslogs with windows.
[size=75]Solaris 10 x86 [color=red][b]||[/b][/color] Cacti - 0.8.7 [color=red][b]||[/b][/color] MySQL - 5.0.45 [color=red][b]||[/b][/color] PHP - 5.2.6 [color=red][b]||[/b][/color] RRDTool - 1.2.23 [color=red][b]||[/b][/color] NET-SNMP - 5.4.1 [color=red][b]||[/b][/color] Syslog-ng 2.0.5
[url=http://www.indigo-networks.com]indigo-networks.com[/url][/size]
spoonman
Cacti User
Posts: 305
Joined: Tue May 03, 2005 8:54 am
Location: GA

Post by spoonman »

Thx nahun - yea Im using Linux. I've already got the database created and the plugin working........I just didnt see anywhere to add stuff???? Let me look at those links.

Thanks.
User avatar
twelzy
Cacti User
Posts: 83
Joined: Wed Mar 30, 2005 6:48 pm
Location: BRAZIL/Brasilia

Post by twelzy »

Which table:

mysql -u XXXX --password=XXXXX syslog < /var/log/mysql.pipe

or

mysql -u XXXX --password=XXXXX syslog_incoming < /var/log/mysql.pipe
?!?!?!


Thanks in advance!
(...and sorry for my poor English!)
Thanks in advance!
(And sorry for my poor English...)
_______________________________________
twelzy (Enio Sanches)
User avatar
nahun
Cacti User
Posts: 92
Joined: Wed Feb 15, 2006 11:27 pm
Location: Idaho
Contact:

Post by nahun »

twelzy wrote:Which table:

mysql -u XXXX --password=XXXXX syslog < /var/log/mysql.pipe

or

mysql -u XXXX --password=XXXXX syslog_incoming < /var/log/mysql.pipe
syslog_incoming. I'm 90% sure. lol
[size=75]Solaris 10 x86 [color=red][b]||[/b][/color] Cacti - 0.8.7 [color=red][b]||[/b][/color] MySQL - 5.0.45 [color=red][b]||[/b][/color] PHP - 5.2.6 [color=red][b]||[/b][/color] RRDTool - 1.2.23 [color=red][b]||[/b][/color] NET-SNMP - 5.4.1 [color=red][b]||[/b][/color] Syslog-ng 2.0.5
[url=http://www.indigo-networks.com]indigo-networks.com[/url][/size]
User avatar
twelzy
Cacti User
Posts: 83
Joined: Wed Mar 30, 2005 6:48 pm
Location: BRAZIL/Brasilia

Post by twelzy »

I decided to log to a file all PHP`s errors:

Code: Select all

[14-Mar-2006 00:14:57] PHP Warning:  Invalid argument supplied for foreach() in /opt/cacti/plugins/haloe/setup.php on line 70
Following, a small part of my unchanged "/opt/cacti/plugins/haloe/setup.php":

Code: Select all

68  if ($sql != '') {
69          $at = db_fetch_assoc($sql);
70          foreach ($at as $a) {
71                  $alertm .= "<table cellpadding=1 cellspacing=0 border=0 bgcolor='#000000' width=500><tr><td><table width='100%' cellpadding=1 cellspacing=0 border=0 bgcolor='#FFFFFF'>\n";
72                  $alertm .= '<tr bgcolor="#dedede"><td>Hostname</td><td>: ' . $a['host'] . "</td></tr>\n";
73                  $alertm .= '<tr bgcolor="#dedede"><td>Date</td><td>: ' . $a['date'] . ' ' . $a['time'] . "</td></tr>\n";
74                  $alertm .= '<tr bgcolor="#dedede"><td>Severity</td><td>: ' . $a['priority'] . "</td></tr>\n";
75                  $alertm .= '<tr bgcolor="#000000"><td colspan=2 height=1>' . "</td></tr>\n";
76                  $alertm .= '<tr><td colspan=2>' . $a['message'] . "\n</td></tr>";
77                  $alertm .= "</table></td></tr></table><br><br>\n";
78          }
79  }
... and no e-mail message is sent!

Anybody has any idea of what is causing this problem?


Thanks in advance!
(...and sorry for my poor English!)
Thanks in advance!
(And sorry for my poor English...)
_______________________________________
twelzy (Enio Sanches)
spoonman
Cacti User
Posts: 305
Joined: Tue May 03, 2005 8:54 am
Location: GA

Post by spoonman »

Guys......I think i've got syslog-ng possibly configured right ... I just got it to create the mysql.log file.......but here is what's inside......

Can't locate DBI.pm in @INC (@INC contains: /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl .) at /usr/local/mysql/bin/mysqlhotcopy line 8.
BEGIN failed--compilation aborted at /usr/local/mysql/bin/mysqlhotcopy line 8.



Any ideas????

Haven't gotten any local logs to input into mysql db yet.
User avatar
nahun
Cacti User
Posts: 92
Joined: Wed Feb 15, 2006 11:27 pm
Location: Idaho
Contact:

Post by nahun »

spoonman wrote: Any ideas????

Haven't gotten any local logs to input into mysql db yet.
Could you post your syslog-ng.conf file?

And maybe to make sure you're getting incoming syslogs do a 'tcpdump port 514' or whatever your syslog port is.
[size=75]Solaris 10 x86 [color=red][b]||[/b][/color] Cacti - 0.8.7 [color=red][b]||[/b][/color] MySQL - 5.0.45 [color=red][b]||[/b][/color] PHP - 5.2.6 [color=red][b]||[/b][/color] RRDTool - 1.2.23 [color=red][b]||[/b][/color] NET-SNMP - 5.4.1 [color=red][b]||[/b][/color] Syslog-ng 2.0.5
[url=http://www.indigo-networks.com]indigo-networks.com[/url][/size]
flavour
Posts: 15
Joined: Wed Sep 28, 2005 9:37 am

Post by flavour »

spoonman wrote: Can't locate DBI.pm in @INC (@INC contains: /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl .) at /usr/local/mysql/bin/mysqlhotcopy line 8.
BEGIN failed--compilation aborted at /usr/local/mysql/bin/mysqlhotcopy line 8.
Need to install the DBI perl module:
http://search.cpan.org/~timb/DBI-1.50/DBI.pm
http://www.rcbowen.com/imho/perl/modules.html

F
User avatar
Viggy
Posts: 23
Joined: Fri Sep 16, 2005 5:15 pm
Location: MI, USA

Remove and Alerting FUnctions

Post by Viggy »

I have to ask a stupid question

Running the following
0.8.6g
Kiwi Syslog
plugin 0.1.2

I have the plugin installed. Syslog data is being displayed inside cacti.

Where is the Alerting and Removal people are talking about? I don't see this option on my screens.
User avatar
nahun
Cacti User
Posts: 92
Joined: Wed Feb 15, 2006 11:27 pm
Location: Idaho
Contact:

Re: Remove and Alerting FUnctions

Post by nahun »

Viggy wrote:I have to ask a stupid question

Running the following
0.8.6g
Kiwi Syslog
plugin 0.1.2

I have the plugin installed. Syslog data is being displayed inside cacti.

Where is the Alerting and Removal people are talking about? I don't see this option on my screens.
Thats an old version of the plugin. http://cactiusers.org/ has 0.2
[size=75]Solaris 10 x86 [color=red][b]||[/b][/color] Cacti - 0.8.7 [color=red][b]||[/b][/color] MySQL - 5.0.45 [color=red][b]||[/b][/color] PHP - 5.2.6 [color=red][b]||[/b][/color] RRDTool - 1.2.23 [color=red][b]||[/b][/color] NET-SNMP - 5.4.1 [color=red][b]||[/b][/color] Syslog-ng 2.0.5
[url=http://www.indigo-networks.com]indigo-networks.com[/url][/size]
tgk
Posts: 28
Joined: Sat Mar 11, 2006 10:46 pm

Bugs in syslog plugin

Post by tgk »

I had the same problem as nahun. The syslog plugin worked fine except for the removals/emails. I found in the cacti log that it was trying to use a column named "message", even when my message column is called "msg", and defined as such in the syslog config file.

Code: Select all

$haloe_config["textField"]       = "msg"; 
... In the cacti.log:

Code: Select all

CMDPHP: Poller[0] ERROR: SQL Exec Failed "delete from syslog_incoming where message like '*******%'"
It seems the plugin has the column name "message" hardcoded. The easy solution is to change your syslog tables to use message instead of msg, and change the plugin config file and syslog-ng config (or whatever syslogger you are using) accordingly.

BTW, the haloe_remove.php file from the plugin has a typo in the first few lines. It reads:

Code: Select all

if (isset($_PSOT['id']))
	$id = $_POST['id'];
... it should be _POST instead of _PSOT
User avatar
nahun
Cacti User
Posts: 92
Joined: Wed Feb 15, 2006 11:27 pm
Location: Idaho
Contact:

Re: Bugs in syslog plugin

Post by nahun »

tgk wrote:I had the same problem as nahun. The syslog plugin worked fine except for the removals/emails. I found in the cacti log that it was trying to use a column named "message", even when my message column is called "msg", and defined as such in the syslog config file.
well actually, I couldn't get the syslogs to go from the syslog_incoming table to the syslog table. I got this error:

Code: Select all

02/22/2006 08:50:47 PM - CMDPHP: Poller[0] ERROR: SQL Exec Failed "UPDATE syslog_incoming set status=1"
But my syslog-ng is using "msg" too, so I'll try changing it to "message" sometime and fix that typo.

Thankst tgk
[size=75]Solaris 10 x86 [color=red][b]||[/b][/color] Cacti - 0.8.7 [color=red][b]||[/b][/color] MySQL - 5.0.45 [color=red][b]||[/b][/color] PHP - 5.2.6 [color=red][b]||[/b][/color] RRDTool - 1.2.23 [color=red][b]||[/b][/color] NET-SNMP - 5.4.1 [color=red][b]||[/b][/color] Syslog-ng 2.0.5
[url=http://www.indigo-networks.com]indigo-networks.com[/url][/size]
mgb
Cacti User
Posts: 124
Joined: Mon Jun 21, 2004 4:06 am
Location: North of the Netherlands

Post by mgb »

@nahun,

I had the same problem as you did
ERROR: SQL Assoc Failed
but after changing msg to message and changing PSOT to POST the faultmessage from the cacti log disapeared and the remove seems to work. Maybe time for a 0.3 version? :wink:
Looks like it's working for me.
Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests