custominet
asked on
Logging with syslog-ng into MySQL
I"m attempting to configure my first syslog-ng as well as piping all the messages to a MySQL database and viewing those entries via php-syslog-ng. PHP-syslog-ng is working and connecting to the database. I"ve "borrowed" example syslog-ng.conf files from all over the internet but I just can't seem to get anything to pipe into the MySQL database. I am, for some reason, creating daily tables but nothing appears in those tables. I believe syslog message are being sent to my server as I have a router sending logging message to the server and it states that nearly 3000 messages have been sent to the syslog server. I'm attaching our syslog-ng.conf as well as the pipe file for your review. Any assistance with this is greatly appreciated.
syslog2mysql.txt
syslog-ng.conf.txt
syslog2mysql.txt
syslog-ng.conf.txt
Is your pipe being written at all? (you can just do a 'cat <filename>')
ASKER
There is a /var/log/mysql.pipe but when I did ca /var/log/mysql.pipe, it just sat there at a blank line until I did CTRL-C to stop it. Also the time stamp is last night at 11:30
So you need to get data into the pipe, that is the first thing to solve.
Which distro are you running?
In RHEL 5 (or simular) and Ubuntu all you need to do to write to a named pipe from syslog is:
# Sample configuration to route kernel debugging
# messages ONLY to /usr/adm/debug which is a
# named pipe.
kern.=debug |/usr/adm/debug
//jonas
Which distro are you running?
In RHEL 5 (or simular) and Ubuntu all you need to do to write to a named pipe from syslog is:
# Sample configuration to route kernel debugging
# messages ONLY to /usr/adm/debug which is a
# named pipe.
kern.=debug |/usr/adm/debug
//jonas
ASKER
I'm running Debian Etch. Is the above supposed to go into the syslog-ng.conf? If not, where does it go?
ASKER
Here's what I"m getting (or not getting seems to be more appropriate)...
mysql> show tables;
+------------------+
| Tables_in_syslog |
+------------------+
| actions |
| all_logs |
| cemdb |
| logs |
| logs20081119 |
| logs20081120 |
| logs20081121 |
| logs20081122 |
| logs20081123 |
| logs20081124 |
| search_cache |
| user_access |
| users |
+------------------+
13 rows in set (0.00 sec)
mysql> select * from logs20081124;
Empty set (0.00 sec)
mysql>
I"m not sure as to why the different tables are being inserted as well as why nothing is in any tables???
mysql> show tables;
+------------------+
| Tables_in_syslog |
+------------------+
| actions |
| all_logs |
| cemdb |
| logs |
| logs20081119 |
| logs20081120 |
| logs20081121 |
| logs20081122 |
| logs20081123 |
| logs20081124 |
| search_cache |
| user_access |
| users |
+------------------+
13 rows in set (0.00 sec)
mysql> select * from logs20081124;
Empty set (0.00 sec)
mysql>
I"m not sure as to why the different tables are being inserted as well as why nothing is in any tables???
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.