Trouble syslog remove

[joseme]

Hi:
I have syslog plugin 1.05, so I tried to config removal using "SQL statement":
String match type : SQL Expression
Syslog match: priority LIKE 'info'

But this doesn´t work, ... I used something like this on "alarms tab" and it works fine, but in removal doesn´t.

Can someone help to solve it?.

joseme

[TheWitness]

Upgrade to 1.22 please.

[joseme]

Hi Witness:
After upgrade to 1.22, I realized something strange. When I click on "graphs" tab I see in Presets: "Last Day" (it's ok for me), then I click on "syslog" tab and see in presets: "Last half hour", after that I go back to"graphs" tab and see in presets "Last Half Hour" selected...uhmm . I could change it manually, but it happens each time I login on cacti (the syslog preset is Half hour). I remember that in syslog 1.05 the default preset was "Last Day".

Thanks..

[TheWitness]

You set the preset in Console->Settings->SysLog. However, I think this is still a bit buggy. I hate the timespan selectors behavior. Want to rewrite it, but so little time, so much to do...

[joseme]

Hi:
thanks for your quick response ... I checked the syslog settings but theres' no an option to select "timespan" selector ( for example for "graphs" you can do it in "settings"...). No trouble, when you have time, you can check it....

Thanks

[joseme]

Hi Wittness:
I was testing remove tab, using "SQL statement", but it doesn't work ( I don´t know if I am making a mistake..., please check it)

1. First test:
Syslog Message Match String: message LIKE '%CONTROLLER-5-UPDOWN%' AND host LIKE '%172.3%'

I see in log:
10/13/2011 08:35:30 AM - CMDPHP: Poller[0] ERROR: A DB Exec Failed!, Error:'1305', SQL:"DELETE FROM `cacti`.`syslog_incoming` WHERE message (message LIKE '%CONTROLLER-5-UPDOWN%' AND host LIKE '%172.3%') AND status='16''

2. Second test:
Syslog Message Match String: message LIKE '%CONTROLLER-5-UPDOWN%'

I see in log:
10/13/2011 09:40:37 AM - CMDPHP: Poller[0] ERROR: A DB Exec Failed!, Error:'1305', SQL:"DELETE FROM `cacti`.`syslog_incoming` WHERE message (message LIKE '%CONTROLLER-5-UPDOWN%') AND status='68''

It seems the trouble is the word "message" before parenthesis...., in spite of I selected "SQL Expression"..., could you check it?..
Thanks.

[joseme]

Hi Wittness:
I was testing "Remove" tab, using "SQL statement", but it doesn't work ( I don´t know if I am making a mistake..., please check it)

1. First test:
Syslog Message Match String: message LIKE '%CONTROLLER-5-UPDOWN%' AND host LIKE '%172.3%'

I see in log:
10/13/2011 08:35:30 AM - CMDPHP: Poller[0] ERROR: A DB Exec Failed!, Error:'1305', SQL:"DELETE FROM `cacti`.`syslog_incoming` WHERE message (message LIKE '%CONTROLLER-5-UPDOWN%' AND host LIKE '%172.3%') AND status='16''

2. Second test:
Syslog Message Match String: message LIKE '%CONTROLLER-5-UPDOWN%'

I see in log:
10/13/2011 09:40:37 AM - CMDPHP: Poller[0] ERROR: A DB Exec Failed!, Error:'1305', SQL:"DELETE FROM `cacti`.`syslog_incoming` WHERE message (message LIKE '%CONTROLLER-5-UPDOWN%') AND status='68''

It seems the trouble is the word "message" before parenthesis...., in spite of I selected "SQL Expression"..., could you check it?..
Thanks.

[TheWitness]

Well, I guess a small change would not hurt.

[toneil]

Are there any updates to this? I'm running into pretty much the same thing.

I've tried:
priority="notice"
priority="notice" and facility="notice"
priority="%notice%" and facility="%notice%"
priority='%notice%' and facility='%notice%'
and message LIKE '%IPsec%'

Cacti.log shows:
07/26/2012 12:50:38 PM - CMDPHP: Poller[0] ERROR: A DB Exec Failed!, Error:'1305', SQL:"DELETE FROM `syslog`.`syslog_incoming` WHERE message (message LIKE IPsec) AND status='114''

Maybe this should be a separate thread:
I notice the syslogging is slow to update once a bit of a load is put on the system. Web and database response time are reasonable. It just seems to lag by hours the time a trap comes into rsyslog to the time it shows up in syslog_incoming. Any suggestions on this?

Version info:

rsyslogd 5.8.10, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No

Date Thu, 26 Jul 2012 12:56:19 -0400
Cacti Version 0.8.7i
Cacti OS unix
SNMP Version NET-SNMP version: 5.5
RRDTool Version RRDTool 1.4.x
Hosts 11
Graphs 55
Data Sources Script/Command: 9
SNMP: 27
SNMP Query: 25
Script Query: 1
Script - Script Server (PHP): 9
Total: 71
Poller Information
Interval 300
Type cmd.php
Items Action[0]: 37
Action[1]: 11
Action[2]: 7
Total: 55
Concurrent Processes 1
Max Threads 1
PHP Servers 1
Script Timeout 25
Max OID 10
Last Run Statistics Time:37.0538 Method:cmd.php Processes:1 Threads:N/A Hosts:9 HostsPerProcess:9 DataSources:55 RRDsProcessed:37
PHP Information
PHP Version 5.3.3
PHP OS Linux
PHP uname Linux cacti.lns.local 2.6.32-279.2.1.el6.x86_64 #1 SMP Fri Jul 20 01:55:29 UTC 2012 x86_64
PHP SNMP Installed
max_execution_time 30
memory_limit 128M
MySQL Table Information
Name Rows Engine Collation
cdef 30 MyISAM utf8_general_ci
cdef_items 58 MyISAM utf8_general_ci
colors 106 MyISAM utf8_general_ci
data_input 13 MyISAM utf8_general_ci
data_input_data 1660 MyISAM utf8_general_ci
data_input_fields 60 MyISAM utf8_general_ci
data_local 71 MyISAM utf8_general_ci
data_template 70 MyISAM utf8_general_ci
data_template_data 141 MyISAM utf8_general_ci
data_template_data_rra 808 MyISAM utf8_general_ci
data_template_rrd 225 MyISAM utf8_general_ci
graph_local 55 MyISAM utf8_general_ci
graph_template_input 120 MyISAM utf8_general_ci
graph_template_input_defs 432 MyISAM utf8_general_ci
graph_templates 51 MyISAM utf8_general_ci
graph_templates_gprint 5 MyISAM utf8_general_ci
graph_templates_graph 106 MyISAM utf8_general_ci
graph_templates_item 1209 MyISAM utf8_general_ci
graph_tree 6 MyISAM utf8_general_ci
graph_tree_items 80 MyISAM utf8_general_ci
host 11 MyISAM utf8_general_ci
host_graph 41 MyISAM utf8_general_ci
host_snmp_cache 869 MyISAM utf8_general_ci
host_snmp_query 10 MyISAM utf8_general_ci
host_template 11 MyISAM utf8_general_ci
host_template_graph 30 MyISAM utf8_general_ci
host_template_snmp_query 17 MyISAM utf8_general_ci
plugin_config 7 MyISAM utf8_general_ci
plugin_db_changes 14 MyISAM utf8_general_ci
plugin_discover_hosts 0 MyISAM utf8_general_ci
plugin_discover_template 0 MyISAM utf8_general_ci
plugin_hooks 68 MyISAM utf8_general_ci
plugin_notification_lists 3 MyISAM utf8_general_ci
plugin_realms 14 MyISAM utf8_general_ci
plugin_thold_contacts 5 MyISAM utf8_general_ci
plugin_thold_host_failed 0 MyISAM utf8_general_ci
plugin_thold_log 16 MyISAM utf8_general_ci
plugin_thold_template_contact 0 MyISAM utf8_general_ci
plugin_thold_threshold_contact 0 MyISAM utf8_general_ci
poller 0 MyISAM utf8_general_ci
poller_command 0 MyISAM utf8_general_ci
poller_item 55 MyISAM utf8_general_ci
poller_output 0 MyISAM utf8_general_ci
poller_output_rt 0 MyISAM latin1_swedish_ci
poller_reindex 7 MyISAM utf8_general_ci
poller_time 1 MyISAM utf8_general_ci
reportit_cache_measurands 0 MyISAM utf8_general_ci
reportit_cache_reports 0 MyISAM utf8_general_ci
reportit_cache_variables 0 MyISAM utf8_general_ci
reportit_data_items 0 MyISAM utf8_general_ci
reportit_data_source_items 0 MyISAM utf8_general_ci
reportit_measurands 0 MyISAM utf8_general_ci
reportit_presets 0 MyISAM utf8_general_ci
reportit_recipients 0 MyISAM utf8_general_ci
reportit_reports 0 MyISAM utf8_general_ci
reportit_rvars 0 MyISAM utf8_general_ci
reportit_templates 0 MyISAM utf8_general_ci
reportit_variables 0 MyISAM utf8_general_ci
rra 5 MyISAM utf8_general_ci
rra_cf 10 MyISAM utf8_general_ci
settings 177 MyISAM utf8_general_ci
settings_graphs 135 MyISAM utf8_general_ci
settings_tree 0 MyISAM utf8_general_ci
snmp_query 8 MyISAM utf8_general_ci
snmp_query_graph 19 MyISAM utf8_general_ci
snmp_query_graph_rrd 39 MyISAM utf8_general_ci
snmp_query_graph_rrd_sv 77 MyISAM utf8_general_ci
snmp_query_graph_sv 56 MyISAM utf8_general_ci
syslog 0 MyISAM utf8_general_ci
syslog_alert 0 MyISAM utf8_general_ci
syslog_facilities 0 MyISAM utf8_general_ci
syslog_host_facilities 0 MyISAM utf8_general_ci
syslog_hosts 0 MyISAM utf8_general_ci
syslog_incoming 0 MyISAM utf8_general_ci
syslog_logs 0 MyISAM utf8_general_ci
syslog_priorities 9 MyISAM utf8_general_ci
syslog_remove 0 MyISAM utf8_general_ci
syslog_removed 0 MyISAM utf8_general_ci
syslog_reports 0 MyISAM utf8_general_ci
syslog_statistics 0 MyISAM utf8_general_ci
thold_data 2 MyISAM utf8_general_ci
thold_template 0 MyISAM utf8_general_ci
user_auth 3 MyISAM utf8_general_ci
user_auth_perms 4 MyISAM utf8_general_ci
user_auth_realm 67 MyISAM utf8_general_ci
user_log 125 MyISAM utf8_general_ci
version 1 MyISAM utf8_general_ci

MySQL Support enabled
Active Persistent Links 1
Active Links 1
Client API version 5.1.61
MYSQL_MODULE_TYPE external
MYSQL_SOCKET /var/lib/mysql/mysql.sock
MYSQL_INCLUDE -I/usr/include/mysql
MYSQL_LIBS -L/usr/lib64/mysql -lmysqlclient

Directive Local Value Master Value
mysql.allow_local_infile On On
mysql.allow_persistent On On
mysql.connect_timeout 60 60
mysql.default_host no value no value
mysql.default_password no value no value
mysql.default_port no value no value
mysql.default_socket /var/lib/mysql/mysql.sock /var/lib/mysql/mysql.sock
mysql.default_user no value no value
mysql.max_links Unlimited Unlimited
mysql.max_persistent Unlimited Unlimited
mysql.trace_mode Off Off

syslog is 1.22-2

[XTech]

Please open file <cacti dir>/plugins/syslog/functions.php in your favorite editor.
Find code:

Code: Select all

                              $sql = "DELETE
                                        FROM `" . $syslogdb_default . "`.`" . $table . "`
                                        WHERE message (" . $remove['message'] . ") AND status='" . $uniqueID . "'";

and delete word message after WHERE. Save file.
Now SQL Removals in your installation must work.

[XTech]

Please open file <cacti dir>/plugins/syslog/functions.php in your favorite editor.
Find code:

Code: Select all

                              $sql = "DELETE
                                        FROM `" . $syslogdb_default . "`.`" . $table . "`
                                        WHERE message (" . $remove['message'] . ") AND status='" . $uniqueID . "'";

and delete word message after WHERE. Save file.
Now SQL Removals in your installation must work.

[toneil]

Thank you for the reply.
Can you tell me approx what line that would be at in the file?

My lines are typically formatted like this:
$sql = "DELETE
FROM `" . $syslogdb_default . "`.`" . $table . "`
WHERE message LIKE '%" . $remove['message'] . "' AND status='" . $uniqueID . "'";


I running version syslog-v1.22-2.

Tom

[XTech]

Line 344 in file functions.php from distribution file syslog-1.22-2.tgz

[toneil]

Hi;

It's got to be something I'm doing wrong:

Syslog Message Match String
The matching component of the syslog message. ---> priority=info

and line 344:

$sql = "DELETE
FROM `" . $syslogdb_default . "`.`" . $table . "`
WHERE (" . $remove['message'] . ") AND status='" . $uniqueID . "'";

07/31/2012 08:20:31 AM - CMDPHP: Poller[0] ERROR: A DB Exec Failed!, Error:'1054', SQL:"DELETE FROM `syslog`.`syslog_incoming` WHERE (priority=info) AND status='39''

Thank you

[XTech]

I use in SQL match expressions like this:

Code: Select all

facility='Syslog' AND priority='Info' AND message='restart'

But for some unclear now to me reasons my functions.php at line 344 looks like that

Code: Select all

                      $sql = "DELETE
                                FROM `" . $syslogdb_default . "`.`" . $table . "`
                                WHERE " . $remove['message'];

I don't remember why I modified it so.