Logging with syslog-ng into MySQL

custominet
custominet used Ask the Experts™
on
I"m attempting to configure my first syslog-ng as well as piping all the messages to a MySQL database and viewing those entries via php-syslog-ng.  PHP-syslog-ng is working and connecting to the database.  I"ve "borrowed" example syslog-ng.conf files from all over the internet but I just can't seem to get anything to pipe into the MySQL database.  I am, for some reason, creating daily tables but nothing appears in those tables.  I believe syslog message are being sent to my server as I have a router sending logging message to the server and it states that nearly 3000 messages have been sent to the syslog server.  I'm attaching our syslog-ng.conf as well as the pipe file for your review.  Any assistance with this is greatly appreciated.  
syslog2mysql.txt
syslog-ng.conf.txt
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
cjl7freelance for hire

Commented:
Is your pipe being written at all? (you can just do a 'cat <filename>')


Author

Commented:
There is a /var/log/mysql.pipe but when I did ca /var/log/mysql.pipe, it just sat there at a blank line until I did CTRL-C to stop it.  Also the time stamp is last night at 11:30
cjl7freelance for hire

Commented:
So you need to get data into the pipe, that is the first thing to solve.

Which distro are you running?

In RHEL 5 (or simular) and Ubuntu all you need to do to write to a named pipe from syslog is:

     # Sample configuration to route kernel debugging
                   # messages ONLY to /usr/adm/debug which is a
                   # named pipe.
                  kern.=debug              |/usr/adm/debug

//jonas
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
I'm running Debian Etch.  Is the above supposed to go into the syslog-ng.conf?  If not, where does it go?

Author

Commented:
Here's what I"m getting (or not getting seems to be more appropriate)...

mysql> show tables;
+------------------+
| Tables_in_syslog |
+------------------+
| actions          |
| all_logs         |
| cemdb            |
| logs             |
| logs20081119     |
| logs20081120     |
| logs20081121     |
| logs20081122     |
| logs20081123     |
| logs20081124     |
| search_cache     |
| user_access      |
| users            |
+------------------+
13 rows in set (0.00 sec)

mysql> select * from logs20081124;
Empty set (0.00 sec)

mysql>

I"m not sure as to why the different tables are being inserted as well as why nothing is in any tables???
freelance for hire
Commented:
You need to focus on the pipe for now, mysql is step 2.

You need to get data into the pipe, that isn't happening.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial