Hi Rainer, > > Hi Michael, > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] [mailto:rsyslog- > > > [EMAIL PROTECTED] On Behalf Of Michael Mansour > > > Sent: Tuesday, August 07, 2007 5:19 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] Is rsyslog 1.17.5 RPM MySQL capable? > > > > > > Hi Rainer, > > > > > > > Michael, > > > > > > > > glad you got that far. I think output modularization brought up an > > > > old issue again: Add a semicolon to the end of the db action line. > > > > The MySQL command line parser is pretty old and could need an > > > > upgrade. I've stayed away from that, because it will be replaced > > > > when we do a new config file format. I'd appreciate if you could > > > > try. I'll also try to repro your bug, but I need to finish something > > > > else first. > > > > > > > > So the line should be like > > > > > > > > *.* > > > > >database-server,database-name,database-userid,database-password; > > > > > > > > NOTE THE END OF THE LINE! > > > > > > Yes that was spot on. I added the semicolon for 1.18.0, ran the debug > > > and it > > > went through and (finally) logged entries into the database (1.17.5 > > > would > > > still segfault). > > > > Interesting - I tried to repro, but so far to no avail. Will check > > and fix.
I'm ignoring this 1.17.5 version now since 1.18.0 is working fine. > > > I then just moved those three binaries in /sbin to .orig and copied > > > across the > > > ones for 1.18.0 into /sbin, then did the "service rsyslog start" and > > > all worked: > > > > > > Aug 8 01:11:37 server rsyslogd: [origin software="rsyslogd" > > > swVersion="1.18.0" x-pid="15789"][x-configInfo udpReception="No" > > > udpPort="514" > > > tcpReception="No" tcpPort="0"] restart > > > Aug 8 01:11:37 server rsyslogd:To enable MySQL logging, a "$ModLoad > > > MySQL" > > > must be done - accepted for the time being, but will fail in future > > > releases. > > > Aug 8 01:11:37 server rsyslog: rsyslogd startup succeeded > > > Aug 8 01:11:37 server rsyslog: rklogd startup succeeded > > > Aug 8 01:11:37 server kernel: rklogd 1.18.0, log source = /proc/kmsg > > > started. > > > > > > where: > > > > > > # rsyslogd -v > > > rsyslogd 1.18.0, compiled with: > > > FEATURE_PTHREADS (dual-threading) > > > FEATURE_REGEXP > > > FEATURE_DB > > > FEATURE_LARGEFILE > > > FEATURE_NETZIP (syslog message compression) > > > SYSLOG_INET (Internet/remote support) > > > > > > See http://www.rsyslog.com for more information. > > > > > > and: > > > > > > # ldd rsyslogd |grep mysql > > > libmysqlclient.so.14 => /usr/lib/mysql/libmysqlclient.so.14 > > > (0x004fb000) > > > > > > and I see the entries getting logged into the SystemEvents table. > > > > > > >From here phpLogCon shows: > > > > > > 5 most recent logs (filter settings apply): > > > > > > No data found! > > > > > > Note: There are 23 events in the database, which are in the future! > > > > I think the "future problem" is probably related to your environment. > > This is most probably the clock skew that make also complained about. > > I worked out why there was the clock skew. Basically I was running > the compile on an nfs mount point, and the server doing the nfs > export was in the future > (I hadn't finished the ntp setup on it). I fixed the ntp setup on > the nfs exported server, and after a few minutes it synced correctly > in time with every other server. > > I also extracted the 1.18.0 tarball into a local filesystem on the server > running rsyslog, and the make went through fine without any clock skew. > > I then moved those newly generated rsyslog files to the /sbin > directory, and started rsyslog and it's logging to the database. > > Currently the database has (from phpLogcon): > > 5 most recent logs (filter settings apply): > > No data found! > > Note: There are 2142 events in the database, which are in the future! > > I'm not sure why it still says "in the future", so what I did was > stop rsyslog, truncate the systemevents table, restart rsyslog, and > still got: > > 5 most recent logs (filter settings apply): > > No data found! > > Note: There are 11 events in the database, which are in the future! > > I know you provided me with a link to a forum on this, so I'll try > and take this issue with phpLogCon up there. > > Do you know of any other software I can use which does was phpLogCon > does? so that I can allow user accounts to login and show syslog > events from the web? > > > > ie. there are events in the database which I can't view, but now this > > > may be > > > due to a database change between 1.17.5 and 1.18.0 ?? > > > > No, its unchanged for at least a year. > > Ok, that rules out that problem out then. > > > > It's too late in the morning now so I'll carry on with this tomorrow > > > sometime. > > > But if you have suggestions on what could be wrong with phpLogCon (ie. > > > why I'm > > > not actually viewing the entries even though events do exist) please > > > let me know. > > > > > > > I'd appreciate if you could post the phpLogCon issue (just copy and > > paste) to > > > > http://www.phplogcon.org/PNphpBB2.phtml > > > > I am right now way to disconnected from it - there are other folks > > who can probably help, but they are not necessarily reading this > > list ;) > > I'll do this now. Although I posted the forum post, after that I read the FAQ: http://www.phplogcon.org/Topic3.phtml which actually solved the problem (by turning off UTC time). That solved the "future problem" displayed within phpLogCon and enabled me to pull rows out of the database. So basically, all is now working as expected and now I'm looking for the ability to use the 1.18.0 backup mysql server feature to complete the setup for redundancy. Where would the docs be for this? I'm also wondering if there are scripts around which will prune database entries over time that I could cron? so the database doesn't keep growing ad infinitum. Thanks for all your assistance so far Rainer. Michael. > > Thanks for your patience and help in getting rsyslog as bug-free as > > possible! > > My pleasure Rainer, your software is also immensely helpful for what > I need to get out of it too, so anything I can do to make it better... > > Michael. > > > Rainer > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > ------- End of Original Message ------- > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog ------- End of Original Message ------- _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
