Syslog - Reports

[socain]

My reports are not emailing and i get this when running with debug:

SYSLOG: We have 1 Reports in the database
Report: New Report Record
PHP Notice: Undefined index: min in /var/www/html/cacti/plugins/syslog/syslog_process.php on line 473
PHP Notice: Undefined index: min in /var/www/html/cacti/plugins/syslog/syslog_process.php on line 474
PHP Notice: Undefined index: hour in /var/www/html/cacti/plugins/syslog/syslog_process.php on line 476
Next Send: 1970-01-01 19:00:00
SYSLOG: Finished processing Reports...
10/21/2010 12:16:17 PM - SYSTEM SYSLOG STATS:Time:0.31 Deletes:0 Incoming:13 Removes:4 XFers:0 Alerts:9 Alarms:0 Reports:1


Thanks!

Cacti Version - 0.8.7g
Plugin Architecture - 2.8
Poller Type - Cactid v
Server Info - Linux 2.6.20-1.2952.fc6
Web Server - Apache/2.2.4 (Fedora)
PHP - 5.1.6
PHP Extensions - libxml, xml, wddx, tokenizer, sysvshm, sysvsem, sysvmsg, standard, SimpleXML, sockets, SPL, shmop, session, Reflection, pspell, posix, mime_magic, iconv, hash, gmp, gettext, ftp, exif, date, curl, ctype, calendar, bz2, zlib, pcre, openssl, apache2handler, gd, ldap, mysql, mysqli, PDO, pdo_mysql, pdo_sqlite
MySQL - 5.0.27-log
RRDTool - 1.2.23
SNMP - 5.3.1
Plugins

• Device Tracking (mactrack - v2.
  Global Plugin Settings (settings - v0.71)
  PHP Network Weathermap (weathermap - v0.96a)
  SuperLinks (superlink - v0.5)
  FlowView (flowview - v0.6)
  Host Info (hostinfo - v0.2)
  Syslog Monitoring (syslog - v1.06)

[TheWitness]

Had not tested reports yet.

TheWitness

[hujer]

I have similar problem. My cacti do not send "reports" from syslog...

cacti version: 0.8.7i
PIA: 3.1
Monitor 1.3
Settings 0.71
Syslog 1.22
Thold 0.4.9

All versions should be the latest

in log with debug logging are records:

cacti.log:03/08/2012 02:51:07 PM - CMDPHP: Poller[0] DEVEL: SQL Exec: "REPLACE INTO `monitoring_cacti`.`settings`

SET name='syslog_stats', value='time:0.14 deletes:0 incoming:0 removes:3 xfers:0 alerts:5 alarms:0 reports:2'"
cacti.log:03/08/2012 02:52:01 PM - CMDPHP: Poller[0] DEVEL: SQL Assoc: "SELECT * FROM

`monitoring_cacti`.`syslog_reports` WHERE enabled='on'"
cacti.log:03/08/2012 02:52:01 PM - SYSTEM SYSLOG STATS:Time:0.18 Deletes:0 Incoming:0 Removes:0 XFers:0 Alerts:5

Alarms:0 Reports:2
cacti.log:03/08/2012 02:52:01 PM - CMDPHP: Poller[0] DEVEL: SQL Exec: "REPLACE INTO `monitoring_cacti`.`settings`

SET name='syslog_stats', value='time:0.18 deletes:0 incoming:0 removes:0 xfers:0 alerts:5 alarms:0 reports:2'"

here it's table export:

INSERT INTO `syslog_reports` (`id`, `name`, `type`, `enabled`, `timespan`, `timepart`, `lastsent`, `body`, `message`, `user`, `date`, `email`, `notes`) VALUES
(1, 'MSTP na switchich AT', 'messagec', 'on', 604800, '32400', 0, 'MSTP na AT switchich', '%STP-W-PORTSTATUS%of%instance%STP%status', 'hujer', 1330681040, 'hhh@zzz.net', ''),
(2, 'sw-penik-435 - stavy Ethernet1/0/12', 'messagec', 'on', 86400, '45000', 0, 'sw-penik-435 - stavy Ethernet1/0/12', '%sw-penik-435%10L2INF/5/PORT LINK STATUS CHANGE(l)%Ethernet1/0/12%', 'hujer', 1330946747, 'hhh@zzz.net', '');

query from syslog db:
SELECT count(*) FROM `syslog` WHERE `message` LIKE '%sw-penik-435%10L2INF/5/PORT LINK STATUS CHANGE(l)%Ethernet1/0/12%'

count(*)
27
- - - - - - -

can anyone advise where the problem might be?

[Lalbee99]

Was able to work around the coding bugs in the syslog_process.php file. I have attached the updated syslog_reports file. I now can create and receive reports. Save off your original syslog_process.php in plugins/syslog. Then download the attached file and rename from syslog_process.txt to syslog_process.php and place it in plugins/syslog directory. You should be good to go.

[hujer]

Thank you.

This script now sending reports. With errors, but its progress
I'll try to find a bug that causes my problem..

Which versions do you use?
(for example: i dont have table syslog_alarm_log)

And is a little sad that the plugin does not use standart cacti function for logging...
(Therefore, I find nothing in the log file from syslog)

hehe is my modification:
file: function.php, function syslog_debug

Code: Select all

function syslog_debug($message) {
        global $syslog_debug;

        /* old condition */
        /* if ($syslog_debug) { */

        /* new condition, solving log option into cacti default settings */
        if (read_config_option('log_verbosity') >= POLLER_VERBOSITY_MEDIUM || $syslog_debug) {

                /*old logging */
                echo "SYSLOG: " . $message . "\n";

                /* adding function for logging into cacti logs/syslog */
                cacti_log("SYSLOG: ".$message, true, "SYSLOG");
        }
}

[Lalbee99]

I am running:

cacti 0.8.7i
PA: 3.1
syslog: 1.22 (svn)

As I have been running (testing) the report functionality I have noticed the following so far:

If you choose a "String Match Type" of: contains (It works)

If you choose a "String Match Type" of: SQL Expression (Does not work)

If you choose a "String Match Type" of: hostname (Does not work)
* this is because it attempts to lookup messages in the syslog.syslog table via a field called host with the user supplied value from "Syslog Message Match String". This will never work because there is no host field in the syslog.syslog table only host_id

If you have more than 1 report scheduled for the same run time it seems to concatenate the 2 entries in 1 report.

[hujer]

ha, I did not know that they are available to SVN versions.
Where are the available svn version (or known bugs)?

About you results, it's correct.
I see, SQL expression part (code) is missing... i can finish.

ADD hostname:
I try this.
But alarm a removal rules works with hostname, but hostname compared with syslog_incomming field.

[hujer]

So..
If someone wanted, here's a better code for direct entry hostname...

modify file: syslog_process.php

Code: Select all

        if ($syslog_report['type'] == 'host') {

                //old - in message must be "host_id"
                //      $sql = "SELECT * FROM `" . $syslogdb_default . "`.`syslog`
                //              WHERE " . $syslog_incoming_config["hostField"] . "='" . $syslog_report['message'] . "'";

                //standart - variant with all columns
                        $sql = "SELECT * FROM `" . $syslogdb_default . "`.`syslog`, `" . $syslogdb_default . "`.`syslog_hosts` ".
                                "WHERE syslog.host_id = syslog_hosts.host_id AND " .
                                $syslog_incoming_config["hostField"] . "='" . $syslog_report['message'] . "'";

                // database-optimalized variant
//                      $sql = "SELECT logtime, message FROM `" . $syslogdb_default . "`.`syslog`, `" . $syslogdb_default . "`.`syslog_hosts` ".
//                              "WHERE syslog.host_id = syslog_hosts.host_id AND " .
//                              $syslog_incoming_config["hostField"] . "='" . $syslog_report['message'] . "'";

                }

Example:

cacti-report.jpg (271.35 KiB) Viewed 4150 times

[pharoz]

Has anyone managed to get the email report to work? I'm running Syslog 1.22. Is there a way to forcefully send a report for testing?