<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>Splitting a single source to multiple mysql tables</TITLE>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2802" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=819120123-07032006><FONT face=Arial
color=#0000ff size=2>nope...</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=819120123-07032006></SPAN> </DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> syslog-ng-bounces@lists.balabit.hu
[mailto:syslog-ng-bounces@lists.balabit.hu] <B>On Behalf Of </B>Dukes
Clayton<BR><B>Sent:</B> Tuesday, March 07, 2006 5:00 PM<BR><B>To:</B> Syslog-ng
users' and developers' mailing list<BR><B>Subject:</B> RE: [syslog-ng] Splitting
a single source to multiple mysql tables<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV dir=ltr align=left><SPAN class=973155922-07032006><FONT face=Arial
color=#0000ff size=2>I think this fixed it, can someone
confirm?</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=973155922-07032006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=973155922-07032006><FONT face=Arial
color=#0000ff size=2>destination d_mysql { pipe("/var/log/mysql.pipe"
template("INSERT INTO logs<BR> (host, facility, priority, level, datetime,
msg)<BR> VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL',
'$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n")<BR> INSERT INTO
host<BR> (host)<BR> VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE
count=count+1;\n")<BR> INSERT IGNORE INTO
facility<BR> (facility)<BR> VALUES ( '$FACILITY'
);\n")<BR> template-escape(yes)); };</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=973155922-07032006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=973155922-07032006><FONT face=Arial
color=#0000ff size=2> log { source(net); destination(d_mysql);
};</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=973155922-07032006></SPAN> </DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> syslog-ng-bounces@lists.balabit.hu
[mailto:syslog-ng-bounces@lists.balabit.hu] <B>On Behalf Of </B>Dukes
Clayton<BR><B>Sent:</B> Tuesday, March 07, 2006 4:43 PM<BR><B>To:</B>
syslog-ng@lists.balabit.hu<BR><B>Subject:</B> [syslog-ng] Splitting a single
source to multiple mysql tables<BR></FONT><BR></DIV>
<DIV></DIV><!-- Converted from text/rtf format -->
<P><FONT face=Arial size=2>Hiya,</FONT> <BR><FONT face=Arial size=2>Here's what
I have, why doesn't it work?</FONT> </P><BR>
<P><FONT face=Arial size=2>destination d_mysql { pipe("/var/log/mysql.pipe"
template("INSERT INTO logs</FONT> <BR><FONT face=Arial size=2> (host,
facility, priority, level, datetime, msg)</FONT> <BR><FONT face=Arial
size=2> VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL',
'$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-esc</FONT> </P>
<P><FONT face=Arial size=2>destination d_host { pipe("/var/log/mysql.pipe"
template("INSERT INTO host</FONT> <BR><FONT face=Arial size=2> (host)
</FONT><BR><FONT face=Arial size=2>VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE
count=count+1;\n") template-escape(yes)); };</FONT> <BR><FONT face=Arial
size=2> </FONT> <BR><FONT face=Arial size=2>destination d_mysql_facility {
pipe("/var/log/mysql.pipe" template("INSERT IGNORE INTO facility</FONT>
<BR><FONT face=Arial size=2> (facility) </FONT><BR><FONT face=Arial
size=2>VALUES ( '$FACILITY' );\n") template-escape(yes)); };</FONT> </P>
<P><FONT face=Arial size=2># This doesn't work</FONT> <BR><FONT face=Arial
size=2>#log { source(net); destination(d_mysql); destination(d_host);
destination(d_mysql_facility); }; </FONT></P>
<P><FONT face=Arial size=2># This works</FONT> <BR><FONT face=Arial
size=2> log { source(net); destination(d_mysql); };</FONT>
</P><BR></BODY></HTML>