Another syslog issue - is there an easy fix?

General discussion about Plugins for Cacti

Moderators: Developers, Moderators

Post Reply
harner
Cacti User
Posts: 75
Joined: Tue Oct 17, 2006 10:21 am
Location: PA, USA

Another syslog issue - is there an easy fix?

Post by harner »

So, here's an interesting tid bit of information for you all. In a month's time, the MySQL syslog database has gone up to 4GB, which zipped to 140MB. We were able to create a script (which is now a weekly cron job) to dump the table information and then zip it.

Anyway, here is where the "Removals" come into play. We have about 70 rules. I just realized that they only work when you create them at first.

For example, if I create a rule stating if a message containing the phrase "non spam" is made, then remove it - it will remove all of the logs with "non spam" in there.
HOWEVER, if a "new" log with the "non spam" phrase is made, it doesn't remove that. It's like we have to recreate the removal scripts. What's up with that?

Thanks.
User avatar
nahun
Cacti User
Posts: 92
Joined: Wed Feb 15, 2006 11:27 pm
Location: Idaho
Contact:

Post by nahun »

There has been some problems with the removal part of the plugin. It might have been fixed with version 0.4, but I'm not sure. I fixed it once myself, but its been a long time and I never use the removal part now. Also my current cacti implementation doesn't have that fix so I wouldn't know how to do it again without a bunch of time.

The big thread for the plugin has a lot of info. I would start with page 8 (where the link puts you). But, a lot of that is for older versions. Its probably changed a lot by now.
[size=75]Solaris 10 x86 [color=red][b]||[/b][/color] Cacti - 0.8.7 [color=red][b]||[/b][/color] MySQL - 5.0.45 [color=red][b]||[/b][/color] PHP - 5.2.6 [color=red][b]||[/b][/color] RRDTool - 1.2.23 [color=red][b]||[/b][/color] NET-SNMP - 5.4.1 [color=red][b]||[/b][/color] Syslog-ng 2.0.5
[url=http://www.indigo-networks.com]indigo-networks.com[/url][/size]
cigamit
Developer
Posts: 3369
Joined: Thu Apr 07, 2005 3:29 pm
Location: B/CS Texas
Contact:

Post by cigamit »

Are you logging directly into the syslog table? Or are you using the syslog_incoming table? I have seen a few users try to bypass the syslog_incoming table, but its where all the rules are applied.
Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests