Hi Rainer,
> Michael,
>
> glad you got that far. I think output modularization brought up an
> old issue again: Add a semicolon to the end of the db action line.
> The MySQL command line parser is pretty old and could need an
> upgrade. I've stayed away from that, because it will be replaced
> when we do a new config file format. I'd appreciate if you could
> try. I'll also try to repro your bug, but I need to finish something
> else first.
>
> So the line should be like
>
> *.*
> >database-server,database-name,database-userid,database-password;
>
> NOTE THE END OF THE LINE!
Yes that was spot on. I added the semicolon for 1.18.0, ran the debug and it
went through and (finally) logged entries into the database (1.17.5 would
still segfault).
I then just moved those three binaries in /sbin to .orig and copied across the
ones for 1.18.0 into /sbin, then did the "service rsyslog start" and all worked:
Aug 8 01:11:37 server rsyslogd: [origin software="rsyslogd"
swVersion="1.18.0" x-pid="15789"][x-configInfo udpReception="No" udpPort="514"
tcpReception="No" tcpPort="0"] restart
Aug 8 01:11:37 server rsyslogd:To enable MySQL logging, a "$ModLoad MySQL"
must be done - accepted for the time being, but will fail in future releases.
Aug 8 01:11:37 server rsyslog: rsyslogd startup succeeded
Aug 8 01:11:37 server rsyslog: rklogd startup succeeded
Aug 8 01:11:37 server kernel: rklogd 1.18.0, log source = /proc/kmsg started.
where:
# rsyslogd -v
rsyslogd 1.18.0, compiled with:
FEATURE_PTHREADS (dual-threading)
FEATURE_REGEXP
FEATURE_DB
FEATURE_LARGEFILE
FEATURE_NETZIP (syslog message compression)
SYSLOG_INET (Internet/remote support)
See http://www.rsyslog.com for more information.
and:
# ldd rsyslogd |grep mysql
libmysqlclient.so.14 => /usr/lib/mysql/libmysqlclient.so.14 (0x004fb000)
and I see the entries getting logged into the SystemEvents table.
>From here phpLogCon shows:
5 most recent logs (filter settings apply):
No data found!
Note: There are 23 events in the database, which are in the future!
ie. there are events in the database which I can't view, but now this may be
due to a database change between 1.17.5 and 1.18.0 ??
It's too late in the morning now so I'll carry on with this tomorrow sometime.
But if you have suggestions on what could be wrong with phpLogCon (ie. why I'm
not actually viewing the entries even though events do exist) please let me
know.
Thanks again.
Michael.
> Please let me know the outcome.
>
> Rainer
> > -----Original Message-----
> > From: [EMAIL PROTECTED] [mailto:rsyslog-
> > [EMAIL PROTECTED] On Behalf Of Michael Mansour
> > Sent: Tuesday, August 07, 2007 4:54 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] Is rsyslog 1.17.5 RPM MySQL capable?
> >
> > Hi,
> >
> > > > Hi,
> > > >
> > > > I went here:
> > > >
> > > > http://people.redhat.com/pvrabec/rpms/rsyslog/
> > > >
> > > > and grabbed the rsyslog-1.17.5-1.src.rpm RPM, I then rebuilt it
> and
> > > > installed
> > > > it onto an SL4.5 server (RHEL 4 U5).
> > > >
> > > > I then setup a MySQL database, and setup the /etc/rsyslog.conf
> file
> > to
> > > > output
> > > > to that database based on the instructions here:
> > > >
> > > > http://www.rsyslog.com/module-Static_Docs-view-f-
> > > > rsyslog_mysql.html.phtml
> > > >
> > > > After all that, I setup phpLogCon.
> > > >
> > > > After all that, I see no entries getting logged into the MySQL
> > > database
> > > > by
> > > > rsyslog. I've checked every step from the beginning and can only
> > come
> > > > to the
> > > > assumption that the rsyslog RPM above is not compiled with MySQL
> > > > support??
> > > >
> > > > Is this assumption valid and if so, why didn't the Red Hat person
> > also
> > > > make a
> > > > mysql one?
> > >
> > > Yes, I think so. I remember there was some discussion around this.
> > I'll
> > > try to find you the bugzilla ticket where this was discussed.
> > > >
> > > > I'm guessing now I need to install from tarball? (I'd prefer RPM
> > which
> > > > is why
> > > > I started there first).
> > >
> > > I am not much into the RPM thing ;) If you have the source available
> > > inside the RPM try, you can eventually do a
> > >
> > > ./configure --enable-mysql
> > >
> > > >
> > > > Any way I can see what the /sbin/rsyslog binary is compiled with?
> > >
> > > rsyslog -v
> > >
> > > will show the compile-time settings.
> > >
> > > This for now, will follow-up soon.
> > > Rainer
> >
> > I've made progress but unfortunately rsyslogd ends up segfaulting when
> > trying
> > to run in mysql mode.
> >
> > I took the rsyslog-1.17.5-1.src.rpm file and installed it, modified
> the
> > /usr/src/redhat/SPECS/rsyslog.spec file to add:
> >
> > %configure --sbindir=%{sbindir} --enable-mysql
> >
> > to the configure line, this then compiled a mysql enabled version
> > (checked
> > with ldd).
> >
> > However, when try to start rsyslogd with the
> >
> > *.* >database-server,database-name,database-userid,database-
> > password
> >
> > entry (filled out to my details) as the last line in
> /etc/rsyslog.conf,
> > the
> > start up hangs. When I comment out the line above, the startup
> > succeeds.
> >
> > When I run this in debug to see what's going on, pages of stuff ending
> > with:
> >
> > Messages with malicious PTR DNS Records are not dropped.
> > Control characters are replaced upon reception.
> > Control character escape sequence prefix is '#'.
> > -1208325536: logmsg: syslog.info<46>, flags 5, from '', msg [origin
> > software="rsyslogd" swVersion="1.17.5" x-pid="11790"][x-configInfo
> > udpReception="No" udpPort="514" tcpReception="No" tcpPort="0"] restart
> > -1208325536: Message has legacy syslog format.
> > -1208325536: enqueueMsg: not yet running on multiple threads
> > -1208325536: Called fprintlog, logging to builtin-file
> > (/var/log/messages)
> > -1208325536: Called fprintlog, logging to builtin-mysqlSegmentation
> > fault
> >
> > a segmentation fault.
> >
> > When I try the same thing with the rsyslog-1.18.0 I compiled earlier:
> >
> > [EMAIL PROTECTED] rsyslog-1.18.0]# ./rsyslogd -m 0 -x -d
> >
> > I get this logged into the messages file:
> >
> > Aug 8 00:48:41 server rsyslogd: [origin software="rsyslogd"
> > swVersion="1.18.0" x-pid="12621"][x-configInfo udpReception="No"
> > udpPort="514"
> > tcpReception="No" tcpPort="0"] restart
> > Aug 8 00:48:41 server rsyslogd:To enable MySQL logging, a "$ModLoad
> > MySQL"
> > must be done - accepted for the time being, but will fail in future
> > releases.
> > Aug 8 00:48:41 server rsyslogd:invalid character in selector line -
> > ';template' expected
> > Aug 8 00:48:41 server rsyslogd:the last error occured in
> > /etc/rsyslog.conf,
> > line 31
> > Aug 8 00:48:41 server rsyslogd:warning: selector line without actions
> > will be
> > discarded
> >
> > but that may be due to not actually doing a "make install" of 1.18.0
> > where the
> > klogd and rfc3195d files installed in the OS are for 1.17.5.
> >
> > If they're not, does it give us a clue to the problem?
> >
> > Thanks,
> >
> > Michael.
> >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
------- End of Original Message -------
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
