Link to home
Start Free TrialLog in
Avatar of custominet
custominetFlag for United States of America

asked on

Logging with syslog-ng into MySQL

I"m attempting to configure my first syslog-ng as well as piping all the messages to a MySQL database and viewing those entries via php-syslog-ng.  PHP-syslog-ng is working and connecting to the database.  I"ve "borrowed" example syslog-ng.conf files from all over the internet but I just can't seem to get anything to pipe into the MySQL database.  I am, for some reason, creating daily tables but nothing appears in those tables.  I believe syslog message are being sent to my server as I have a router sending logging message to the server and it states that nearly 3000 messages have been sent to the syslog server.  I'm attaching our syslog-ng.conf as well as the pipe file for your review.  Any assistance with this is greatly appreciated.  
syslog2mysql.txt
syslog-ng.conf.txt
Avatar of cjl7
cjl7
Flag of Sweden image

Is your pipe being written at all? (you can just do a 'cat <filename>')


Avatar of custominet

ASKER

There is a /var/log/mysql.pipe but when I did ca /var/log/mysql.pipe, it just sat there at a blank line until I did CTRL-C to stop it.  Also the time stamp is last night at 11:30
So you need to get data into the pipe, that is the first thing to solve.

Which distro are you running?

In RHEL 5 (or simular) and Ubuntu all you need to do to write to a named pipe from syslog is:

     # Sample configuration to route kernel debugging
                   # messages ONLY to /usr/adm/debug which is a
                   # named pipe.
                  kern.=debug              |/usr/adm/debug

//jonas
I'm running Debian Etch.  Is the above supposed to go into the syslog-ng.conf?  If not, where does it go?
Here's what I"m getting (or not getting seems to be more appropriate)...

mysql> show tables;
+------------------+
| Tables_in_syslog |
+------------------+
| actions          |
| all_logs         |
| cemdb            |
| logs             |
| logs20081119     |
| logs20081120     |
| logs20081121     |
| logs20081122     |
| logs20081123     |
| logs20081124     |
| search_cache     |
| user_access      |
| users            |
+------------------+
13 rows in set (0.00 sec)

mysql> select * from logs20081124;
Empty set (0.00 sec)

mysql>

I"m not sure as to why the different tables are being inserted as well as why nothing is in any tables???
ASKER CERTIFIED SOLUTION
Avatar of cjl7
cjl7
Flag of Sweden image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial