Syslog Message Lag Time

[cperry7467]

I just setup cacti 0.8.8b yesterday on CentOS6.5 with one of the main goals to create some alerting on Syslog messages. I have the basics working, syslog messages show up and I get email alerts but the lag time for messages to show up in the Syslog viewer is higher than I would like. I can go and generate a Syslog message from a router but sometimes it takes up to 5 minutes before it shows in the viewer. Is there anyway to increase the frequency? I'm assuming the way it works is rsyslog sends the messages to mysql and cacti checks for new messages every so often?

[cigamit]

If your Cacti cron is set to 5 minutes, the syslog processor runs after the cacti polling, so it will basically run at the same interval as your Cron.
You could also setup a separate cron directly for the syslog process, just set it up to run
/plugins/syslog/syslog_process.php

[cperry7467]

If your Cacti cron is set to 5 minutes, the syslog processor runs after the cacti polling, so it will basically run at the same interval as your Cron.
You could also setup a separate cron directly for the syslog process, just set it up to run
/plugins/syslog/syslog_process.php

I'd prefer to not have the polling more than every 5 minutes so the cron sounds like a better idea to me. I tried creating one but it doesn't seem to be operating any faster so I assume I don't have it setup right. Does it just need to be:

*/1 * * * * root /usr/share/cacti/plugins/syslog/syslog_process.php

[cigamit]

If your Cacti cron is set to 5 minutes, the syslog processor runs after the cacti polling, so it will basically run at the same interval as your Cron.
You could also setup a separate cron directly for the syslog process, just set it up to run
/plugins/syslog/syslog_process.php

I'd prefer to not have the polling more than every 5 minutes so the cron sounds like a better idea to me. I tried creating one but it doesn't seem to be operating any faster so I assume I don't have it setup right. Does it just need to be:

*/1 * * * * root /usr/share/cacti/plugins/syslog/syslog_process.php

Well, you have to tell it to use php to run it, so just mod it after your cacti poller. I should have either php or /pathtophp/php in front of it. You probably also will want to add a pipe to /dev/null at the end too, to suppress any output.

[cperry7467]

Changed it to
*/1 * * * * root /usr/bin/php /usr/share/cacti/plugins/syslog/syslog_process.php > /dev/null

But it still doesn't appear to be any faster.

[cperry7467]

Actually it looks like I got it working by removing "root" from it. Just as a reference for folks in the future, I did
sudo crontab -e
Which opens a vi editor for cron jobs for root

Use "i" to enter insert mode, and enter (except change your file path if necessary)

*/1 * * * * /usr/bin/php /usr/share/cacti/plugins/syslog/syslog_process.php > /dev/null

Hit esc then :wq! to save and exit.