Syslog monitor addon beta

[cdukes]

Yes,
Just re-arrange your syslog-ng insert statement to match. (ignore the seq, it is auto increment)

Do the tables have to match in exact order??

mysql> show create table syslog_incoming \G
*************************** 1. row ***************************
Table: syslog_incoming
Create Table: CREATE TABLE `syslog_incoming` (
`facility` varchar(10) default NULL,
`priority` varchar(10) default NULL,
`date` date default NULL,
`time` time default NULL,
`host` varchar(128) default NULL,
`message` text,
`seq` int(10) unsigned NOT NULL auto_increment,
`status` tinyint(4) NOT NULL default '0',
PRIMARY KEY (`seq`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1
1 row in set (0.01 sec)

mysql>


Thanks

[spoonman]

Perfect..........I now have syslogs in cacti..THX cdukes.
now to tweak alittle and get the colors.
Thanks

[spoonman]

One more question to the group........just set up a Win2k3 server to send all its logs to cacti...I see them>> AWESOME. in the list they show up as that machines IP..is there a way to get its DNS name??? My cacti server has DNS setup and I can ping that server by its name?? Any suggestions?

[nahun]

I think it may depend on the device or its syslog program. I have many different types of devices (APs, firewalls, routers, computers) syslogging and some show their name and some show their IP address for the host.

It would be nice to use the name, maybe someone knows?

[cdukes]

It's your syslog-ng config, try this:

Code: Select all

###########################################################################################
# May 05, 2006 Added by cdukes for php-syslog-ng // ref: http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG
# pipe messages to /var/log/mysql.pipe to be processed by mysql
###########################################################################################
options { 
        long_hostnames(off); 

        # doesn't actually help on Solaris, log(3) truncates at 1024 chars
        log_msg_size(8192);

        # buffer just a little for performance
        sync(1); 

        # memory is cheap, buffer messages unable to write (like to loghost)
        log_fifo_size(16384); 

        # Hosts we don't want syslog from
        #bad_hostname("^(ctld.|cmd|tmd|last)$");

        # The time to wait before a dead connection is reestablished (seconds)
        time_reopen(10);

        #Use DNS so that our good names are used, not hostnames
        use_dns(yes);
        dns_cache(yes);

        #Use the whole DNS name
        use_fqdn(yes);

        keep_hostname(yes);
        chain_hostnames(no);

        #Read permission for everyone
        perm(0644);

        # The default action of syslog-ng 1.6.0 is to log a STATS line
        # to the file every 10 minutes.  That's pretty ugly after a while.
        # Change it to every 12 hours so you get a nice daily update of
        # how many messages syslog-ng missed (0).
        stats(43200); 
};
destination d_mysql {
        pipe("/var/log/mysql.pipe"
                template("INSERT INTO logs
                (host, facility, priority, level, tag, datetime, program, msg)
                VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC
', '$PROGRAM', '$MSG' );\n") template-escape(yes));
};

log {
        source(s_all);
        destination(d_mysql);
};

###########################################################################################
# May 05, 2006 Added above by cdukes for php-syslog-ng enhancements
###########################################################################################

I think it may depend on the device or its syslog program. I have many different types of devices (APs, firewalls, routers, computers) syslogging and some show their name and some show their IP address for the host.

It would be nice to use the name, maybe someone knows?

[spoonman]

You are the man cdukes......works like a charm.
I havent tested with other types of devices , just a few servers so far. I get the fqdn now....will turn that back off...dont need it really. Now that you told me about those settings I do remember seeing them. Thanks again.

[cdukes]

No problem man, glad to help

You are the man cdukes......works like a charm.
I havent tested with other types of devices , just a few servers so far. I get the fqdn now....will turn that back off...dont need it really. Now that you told me about those settings I do remember seeing them. Thanks again.

[hmc_hut]

im using syslog4.0 . it is runing. but select all host only localhost. how do you do to add nother Host .

[azel]

hi
according to the included help and the the help on cactiusers, i put all files into the <cacti>/plugin/haloe/ folder. i made necessary changes to the corresponding config files, created a new table for my rsyslog (which logs successfully) added $plugin to include/config.php and so on.
but i'm not able to integrate the 0.4 plugin into cacti. where do i have to put the files exactly?

thx in advance

[nahun]

If you know the syslogs are getting into the database, but there just isn't a tab showing, maybe check your user permissions in Cacti and make sure your user can see the syslog stuff. I forget that all the time.

[hmc_hut]

syslog-ng,conf

options {
# use_fqdn(yes);
# use_dns(yes);
# dns_cache(yes);
# keep_hostname(yes);
long_hostnames(yes);
sync(1);
log_fifo_size(1024);
};

source src {unix-stream("/dev/log");
file("/proc/kmsg");
udp();
tcp();
internal();};



destination d_mysql {
program("/usr/bin/mysql -u cactiuser --password=somepassword syslog < /var/log/mysql.pipe");
pipe("/var/log/mysql.pipe"
template("INSERT INTO syslog_incoming (facility, priority , date , time , host , message , seq , status ) VALUES ('$FACILITY','$PRIORITY','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC','$HOST', '$MESSAGE','$SEQ','$STATUS') ;\n") template-escape(yes));
};

log {
source(src);
destination(d_mysql);
};

dont config good ?

[spoonman]

To get other servers or switches to appear you have to point each one to your cacti server...or tell it to send all its logs to it. They will appear once you do that. The only thing I've tested so far is a Win2k3 server sending event/application/secutiry logs to it. You have to get another program to run on each Win server to do that. I downloaded a program call NTSyslog for free and installed it and started sending logs to cacti..they appeared pretty quick. Google that app, its nice.......think is was a sourceforge app???

[qwertz]

Hello,

When i try to execute my bash script (syslog2mysql), i have the following error ...

ERROR 1136 at line 1: Column count doesn't match value count at row 1

I added the following in syslog-ng.conf

# pipe messages to /var/log/mysql.pipe to be processed by mysql

destination d_mysql {
pipe("/var/log/mysql.pipe"
template("INSERT syslog_incoming
(facility, priority, date, time, host, message, seq, status)
VALUES ( '$FACILITY', '$PRIORITY', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC',
'$MSG', '$SEQ', '$STATUS' );\n") template-escape(yes));
};

Below, my config.php file in the haloe folder

// Field Mappings, adjust to match the haloe table columns in use
$haloe_config["haloeTable"] = "syslog";
$haloe_config["incomingTable"] = "syslog_incoming";
$haloe_config["removeTable"] = "syslog_remove";
$haloe_config["alertTable"] = "syslog_alert";
$haloe_config["dateField"] = "date";
$haloe_config["timeField"] = "time";
$haloe_config["priorityField"] = "priority";
$haloe_config["facilityField"] = "facility";
$haloe_config["hostField"] = "host";
$haloe_config["textField"] = "message";
$haloe_config["id"] = "seq";


And I have the following fields in my table syslog_incoming:

- facility
- priority
- date
- time
- host
- message
- seq
- status


I don't understant the SQL error ...

Can you help me?

Thanks in advance

Qwertz

[cigamit]

destination d_mysql {
pipe("/var/log/mysql.pipe"
template("INSERT syslog_incoming
(facility, priority, date, time, host, message, seq, status)
VALUES ( '$FACILITY', '$PRIORITY', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC',
'$MSG', '$SEQ', '$STATUS' );\n") template-escape(yes));
};

Maybe this

Code: Select all

 template("INSERT syslog_incoming 

should be

Code: Select all

 template("INSERT INTO syslog_incoming 

Just the first thing that caught my eye.

[qwertz]

THANKS it's working.

i noticed that i forgot '$HOST' too. that's why a had the column count error

Qwertz