Just send from all your remote syslog-ng boxes to a local syslog-ng receiver.<div>Then just use that local syslog-ng to send to mysql.</div><div><br></div><div>Here's an example of client and server configs in the LogZilla forums:</div>
<div><a href="http://forum.logzilla.pro/index.php/topic,482.msg2468.html#msg2468">http://forum.logzilla.pro/index.php/topic,482.msg2468.html#msg2468</a>
</div><div><br></div><div>But basically, you just configure a destination in the client pointing to the syslog-ng server. (I recommend using tcp)</div><div>then, in the server, set the destination as mysql.</div><div><br>
</div><div><br></div><div><br></div><div><br clear="all">______________________________________________________________ <br><br>Clayton Dukes<br>______________________________________________________________<br>
<br><br><div class="gmail_quote">On Wed, Aug 15, 2012 at 12:24 PM, James McDonald <span dir="ltr"><<a href="mailto:jmcdonald@lce.com" target="_blank">jmcdonald@lce.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Do you have syslog-NG sending logs to a separate MySQL server, or do you have MySQL installed on the same server as syslog-NG? Since we have multiple syslog-NG servers, we were trying to centralize everything on a MySQL server and then make that db searchable. I was hoping to get some direction on how to have everything sent to the MySQL db server. That’s my first hurdle<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Clayton Dukes [mailto:<a href="mailto:cdukes@gmail.com" target="_blank">cdukes@gmail.com</a>] <br>
<b>Sent:</b> Wednesday, August 15, 2012 12:17 PM<br><b>To:</b> James McDonald<br><b>Cc:</b> Syslog-ng users' and developers' mailing list</span></p><div><div class="h5"><br><b>Subject:</b> Re: [syslog-ng] syslog-ng with MySQL<u></u><u></u></div>
</div><p></p><div><div class="h5"><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">It works fine on Redhat, but the Redhat Repo's have old versions of MySQL and PHP so you need to manually download the binaries from MySQL and Zend.<u></u><u></u></p>
<div><p class="MsoNormal" style="margin-bottom:12.0pt"><br clear="all">______________________________________________________________ <br><br>Clayton Dukes<br>______________________________________________________________<br>
<br><u></u><u></u></p><div><p class="MsoNormal">On Wed, Aug 15, 2012 at 12:12 PM, James McDonald <<a href="mailto:jmcdonald@lce.com" target="_blank">jmcdonald@lce.com</a>> wrote:<u></u><u></u></p><div><div><p class="MsoNormal">
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">We are using Red Hat for all of our Linux boxes. We update them monthly, but Red Hat was listed as a liability on the Logzilla website. Are you using Red Hat or Ubuntu?</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>] <b>On Behalf Of </b>Clayton Dukes<br>
<b>Sent:</b> Wednesday, August 15, 2012 11:35 AM</span><u></u><u></u></p><div><div><p class="MsoNormal"><br><b>To:</b> Syslog-ng users' and developers' mailing list<br><b>Subject:</b> Re: [syslog-ng] syslog-ng with MySQL<u></u><u></u></p>
</div></div><div><div><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">You can also try LogZilla (<a href="http://www.logzilla.pro" target="_blank">http://www.logzilla.pro</a>).<u></u><u></u></p><div><p class="MsoNormal">
<u></u><u></u></p></div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><br clear="all">______________________________________________________________ <br><br>Clayton Dukes<br>______________________________________________________________<u></u><u></u></p>
<div><p class="MsoNormal">On Wed, Aug 15, 2012 at 11:26 AM, James McDonald <<a href="mailto:jmcdonald@lce.com" target="_blank">jmcdonald@lce.com</a>> wrote:<u></u><u></u></p><div><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I read through the comments and it seems people are having problems with the install and/or getting queries to run. I currently have syslog-NG version 4.1 and MySQL version 5.5.25. Will the installer error out, since it’s based on older versions of those two programs?</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p><div><div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>] <b>On Behalf Of </b>Erol Blakely<br>
<b>Sent:</b> Wednesday, August 15, 2012 10:53 AM<br><b>To:</b> Syslog-ng users' and developers' mailing list<br><b>Subject:</b> Re: [syslog-ng] syslog-ng with MySQL</span><u></u><u></u></p></div></div><div><div><p class="MsoNormal">
<u></u><u></u></p><div><p class="MsoNormal">We are trying this out and so far it has been working nicely:<u></u><u></u></p></div><div><p class="MsoNormal"> <u></u><u></u></p></div><div><p class="MsoNormal"><a href="http://code.google.com/p/enterprise-log-search-and-archive/" target="_blank">http://code.google.com/p/enterprise-log-search-and-archive/</a><u></u><u></u></p>
</div><div><p class="MsoNormal"> <u></u><u></u></p></div><div><p class="MsoNormal"> <u></u><u></u></p></div><p class="MsoNormal"> <u></u><u></u></p><div><div><p class="MsoNormal">On 2012-08-15, at 10:47 AM, James McDonald wrote:<u></u><u></u></p>
</div><p class="MsoNormal" style="margin-bottom:12.0pt"> <u></u><u></u></p><div><p class="MsoNormal" style="margin-bottom:12.0pt">Trying to incorporate a MySQL db (on a separate server) with my two<br>syslog-ng servers, so that the logs can be searchable. Does anyone have any<br>
experience with this? Any tips or documentation would be helpful. I didn't<br>find a whole lot on the Balabit website when I searched for it.<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><u></u><u></u></p></div></div><p class="MsoNormal"> <u></u><u></u></p><div><div><div><p class="MsoNormal">
--<u></u><u></u></p></div><div><p class="MsoNormal">Erol Blakely - <a href="mailto:erol@easydns.com" target="_blank">erol@easydns.com</a><u></u><u></u></p></div><div><p class="MsoNormal">Systems Administrator<u></u><u></u></p>
</div><div><p class="MsoNormal">easyDNS Technologies Inc.<u></u><u></u></p></div></div></div><p class="MsoNormal"> <u></u><u></u></p></div></div></div></div><p class="MsoNormal" style="margin-bottom:12.0pt"><br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><u></u><u></u></p></div><p class="MsoNormal"> <u></u><u></u></p></div></div></div></div></div></div><p class="MsoNormal">
<u></u> <u></u></p></div></div></div></div></div></blockquote></div><br></div>