<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt"><div style="" class="">Hello Guys,</div><div style="" class=""><br style="" class=""></div><div class="" style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal">I am new in Syslog-ng application and also Linux and I need your help regarding the functionality of syslog-ng on Linux. I am building a syslog-ng server capable of receiving syslog messages from syslog-ng clients. In doing so, I would like to those syslog messages to be received and stored inside the Syslog MySQL database of the server inside the syslog_incoming table so that I can be able view those messages. I am using the Centos 6.5 of Redhat distributions and the Syslog-ng application running on
that PC acts as a Syslog-ng server. This is my first attempt to allow the syslog messages storage on the database:</div><div class="" style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal"> @version:3.2<br style="" class=""><br style="" class=""># syslog-ng configuration file.<br style="" class="">#<br style="" class=""># This should behave pretty much like the original syslog on RedHat. But<br style="" class=""># it could be configured a lot smarter.<br style="" class="">#<br style="" class=""># See syslog-ng(8) and syslog-ng.conf(5) for more information.<br style="" class="">#<br style="" class=""><br style="" class="">options {<br style="" class=""> flush_lines (0);<br style="" class=""> time_reopen (10);<br style=""
class=""> log_fifo_size (1000);<br style="" class=""> long_hostnames (off);<br style="" class=""> use_dns (no);<br style="" class=""> use_fqdn (no);<br style="" class=""> create_dirs (no);<br style="" class=""> keep_hostname (yes);<br style="" class="">};<br style="" class=""><br style="" class=""><br style="" class="">#source s_sys {<br style="" class=""> #file ("/proc/kmsg" program_override("kernel: "));<br style="" class=""> # unix-stream ("/dev/log");<br style="" class=""> # internal();<br style="" class=""> # udp(ip(0.0.0.0) port(514));<br style="" class="">#};<br style="" class=""><br style="" class="">#A change was made
here!<br style="" class="">source network { syslog(ip(0.0.0.0) port(514) transport(udp));};<br style="" class=""><br style="" class="">destination db_mysql{sql(type(mysql) host("localhost") username("cacti") password("P@ssw0rd") database("syslog")<br style="" class=""> table("syslog_incoming")<br style="" class=""> columns("host", "facility", "priority", "date", "time", "message")<br style="" class=""> values("$HOST","$FACILITY","$PRIORITY","$YEAR-$MONTH-$DAY","$HOUR:$MIN:$SEC","$MSG")<br style=""
class=""> indexes("host", "facility", "priority", "date", "time", "message")<br style="" class=""> );};<br style="" class=""><br style="" class="">destination d_cons { file("/dev/console"); };<br style="" class="">destination d_mesg { file("/var/log/messages"); };<br style="" class="">destination d_auth { file("/var/log/secure"); };<br style="" class="">destination d_mail { file("/var/log/maillog" flush_lines(10)); };<br style="" class="">destination d_spol { file("/var/log/spooler"); };<br style="" class="">destination d_boot { file("/var/log/boot.log"); };<br style="" class="">destination d_cron { file("/var/log/cron"); };<br style="" class="">destination d_kern { file("/var/log/kern"); };<br style=""
class="">destination d_mlal { usertty("*"); };<br style="" class=""><br style="" class="">filter f_kernel { facility(kern); };<br style="" class="">filter f_default { level(info..emerg) and<br style="" class=""> not (facility(mail)<br style="" class=""> or facility(authpriv)<br style="" class=""> or facility(cron)); };<br style="" class="">filter f_auth { facility(authpriv); };<br style="" class="">filter f_mail { facility(mail); };<br
style="" class="">filter f_emergency { level(emerg); };<br style="" class="">filter f_news { facility(uucp) or<br style="" class=""> (facility(news)<br style="" class=""> and level(crit..emerg)); };<br style="" class="">filter f_boot { facility(local7); };<br style="" class="">filter f_cron { facility(cron); };<br style="" class=""><br style="" class="">#A change was made here!<br style="" class=""><br style="" class="">log { source(s_sys);source(network); destination(d_mysql);};<br style="" class="">#log { source(network); destination(d_mysql);};<br style="" class=""><br style="" class=""><br style="" class="">#log {
source(s_sys); filter(f_kernel); destination(d_cons); };<br style="" class="">#log { source(s_sys); filter(f_kernel); destination(d_kern); };<br style="" class="">#log { source(s_sys); filter(f_default); destination(d_mesg); };<br style="" class="">#log { source(s_sys); filter(f_auth); destination(d_auth); };<br style="" class="">#log { source(s_sys); filter(f_mail); destination(d_mail); };<br style="" class="">#log { source(s_sys); filter(f_emergency); destination(d_mlal); };<br style="" class="">#log { source(s_sys); filter(f_news); destination(d_spol); };<br style="" class="">#log { source(s_sys); filter(f_boot); destination(d_boot); };<br style="" class="">#log { source(s_sys); filter(f_cron); destination(d_cron); };<br style="" class=""><br style="" class=""># vim:ft=syslog-ng:ai:si:ts=4:sw=4:et:<br style="" class=""></div><div class="" style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida
Grande,sans-serif; background-color: transparent; font-style: normal">destination d_cons { file("/dev/console"); };<br style="" class="">destination d_mesg { file("/var/log/messages"); };<br style="" class="">destination d_auth { file("/var/log/secure"); };<br style="" class="">destination d_mail { file("/var/log/maillog" flush_lines(10)); };<br style="" class="">destination d_spol { file("/var/log/spooler"); };<br style="" class="">destination d_boot { file("/var/log/boot.log"); };<br style="" class="">destination d_cron { file("/var/log/cron"); };<br style="" class="">destination d_kern { file("/var/log/kern"); };<br style="" class="">destination d_mlal { usertty("*"); };<br style="" class=""><br style="" class="">filter f_kernel { facility(kern); };<br style="" class="">filter f_default { level(info..emerg) and<br style=""
class=""> not (facility(mail)<br style="" class=""> or facility(authpriv)<br style="" class=""> or facility(cron)); };<br style="" class="">filter f_auth { facility(authpriv); };<br style="" class="">filter f_mail { facility(mail); };<br style="" class="">filter f_emergency { level(emerg); };<br style="" class="">filter f_news { facility(uucp) or<br style=""
class=""> (facility(news)<br style="" class=""> and level(crit..emerg)); };<br style="" class="">filter f_boot { facility(local7); };<br style="" class="">filter f_cron { facility(cron); };<br style="" class=""><br style="" class="">#A change was made here!<br style="" class=""><br style="" class="">log { source(network); destination(d_mysql);};<br style="" class=""><br style="" class=""><br style="" class=""><br style="" class="">#log { source(s_sys); filter(f_kernel); destination(d_cons); };<br style="" class="">#log { source(s_sys); filter(f_kernel); destination(d_kern); };<br style="" class="">#log { source(s_sys); filter(f_default); destination(d_mesg);
};<br style="" class="">#log { source(s_sys); filter(f_auth); destination(d_auth); };<br style="" class="">#log { source(s_sys); filter(f_mail); destination(d_mail); };<br style="" class="">#log { source(s_sys); filter(f_emergency); destination(d_mlal); };<br style="" class="">#log { source(s_sys); filter(f_news); destination(d_spol); };<br style="" class="">#log { source(s_sys); filter(f_boot); destination(d_boot); };<br style="" class="">#log { source(s_sys); filter(f_cron); destination(d_cron); };<br style="" class=""><br style="" class=""># vim:ft=syslog-ng:ai:si:ts=4:sw=4:et:<br style="" class=""><br style="" class=""></div><div class="" style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal"> And this is the message I got when I tried to restart the application : <br style="" class=""></div><div style="" class=""
id="yiv3604323247"><div style="" class=""><div class="" style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt"><div style="" class="" id="yiv3604323247yui_3_13_0_1_1399456060016_3142"></div></div></div></div><span style="" class="">Stopping syslog-ng: [FAILED]<br style="" class="">Starting syslog-ng: Error in configuration, unresolved destination reference; destination='d_mysql'<br style=""
class=""> [FAILED]<br style="" class="">Then I tried to use a named pipe to accept and send thoses messages to the syslog_incoming table of the Syslog MySQL database through a template:<br style="" class=""><br style="" class="">@version:3.2<br style="" class=""><br style="" class=""># syslog-ng configuration file.<br style="" class="">#<br style="" class=""># This should behave pretty much like the original syslog on RedHat. But<br style="" class=""># it could be configured a lot smarter.<br style="" class="">#<br style="" class=""># See syslog-ng(8) and syslog-ng.conf(5) for more information.<br style=""
class="">#<br style="" class=""><br style="" class="">options {<br style="" class=""> flush_lines (0);<br style="" class=""> time_reopen (10);<br style="" class=""> log_fifo_size (1000);<br style="" class=""> long_hostnames (off);<br style="" class=""> use_dns (no);<br style="" class=""> use_fqdn (no);<br style="" class=""> create_dirs (no);<br style="" class=""> keep_hostname (yes);<br style="" class="">};<br style="" class=""><br style="" class=""><br style="" class="">#source s_sys {<br style="" class=""># file ("/proc/kmsg" program_override("kernel: "));<br style=""
class=""># unix-stream ("/dev/log");<br style="" class=""># internal();<br style="" class=""># udp(ip(0.0.0.0) port(514));<br style="" class="">#};<br style="" class="">destination d_mysql{ pipe("/var/log/mysql.pipe" <br style="" class="">template("INSERT INTO syslog_incoming(host, facility, priority, date, time, message) <br style="" class="">VALUES('$HOST', '$FACILITY', '$PRIORITY', '$ YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$MSG');\n") <br style="" class="">template-escape(yes));<br style="" class="">};<br style="" class="">destination d_cons { file("/dev/console"); };<br style="" class="">destination d_mesg { file("/var/log/messages"); };<br style="" class="">destination d_auth { file("/var/log/secure"); };<br style="" class="">destination d_mail { file("/var/log/maillog" flush_lines(10)); };<br style="" class="">destination d_spol { file("/var/log/spooler"); };<br style=""
class="">destination d_boot { file("/var/log/boot.log"); };<br style="" class="">destination d_cron { file("/var/log/cron"); };<br style="" class="">destination d_kern { file("/var/log/kern"); };<br style="" class="">destination d_mlal { usertty("*"); };<br style="" class=""><br style="" class="">filter f_kernel { facility(kern); };<br style="" class="">filter f_default { level(info..emerg) and<br style="" class=""> not (facility(mail)<br style="" class=""> or facility(authpriv)<br style="" class=""> or
facility(cron)); };<br style="" class="">filter f_auth { facility(authpriv); };<br style="" class="">filter f_mail { facility(mail); };<br style="" class="">filter f_emergency { level(emerg); };<br style="" class="">filter f_news { facility(uucp) or<br style="" class=""> (facility(news)<br style="" class=""> and level(crit..emerg)); };<br style="" class="">filter f_boot { facility(local7); };<br style="" class="">filter f_cron { facility(cron); };<br style="" class=""><br style="" class="">#A change was made here!<br style="" class=""><br style=""
class="">log { source(network); destination(d_mysql);};<br style="" class="">#log { source(network); destination(d_mysql);};<br style="" class=""><br style="" class=""><br style="" class="">#log { source(s_sys); filter(f_kernel); destination(d_cons); };<br style="" class="">#log { source(s_sys); filter(f_kernel); destination(d_kern); };<br style="" class="">#log { source(s_sys); filter(f_default); destination(d_mesg); };<br style="" class="">#log { source(s_sys); filter(f_auth); destination(d_auth); };<br style="" class="">#log { source(s_sys); filter(f_mail); destination(d_mail); };<br style="" class="">#log { source(s_sys); filter(f_emergency); destination(d_mlal); };<br style="" class="">#log { source(s_sys); filter(f_news); destination(d_spol); };<br style="" class="">#log { source(s_sys); filter(f_boot); destination(d_boot); };<br style="" class="">#log { source(s_sys); filter(f_cron); destination(d_cron); };<br style="" class=""><br style=""
class=""># vim:ft=syslog-ng:ai:si:ts=4:sw=4:et:<br style="" class="">And I got this message assuming that the syslog-ng server is working<br>Stopping syslog-ng: [ OK ]<br style="" class="">Starting syslog-ng: [ OK ]<br style="" class=""><br>But when I checked to the table of the database it was empty.<br><br>So, I would like to know, do you miss something on the first attempt to allow the syslog-server to work perfectly or should I just not to uncomment the source system
(s_sys) to accept the syslog messages from the Syslog-clients? On the 2nd attempt, what needs to be done to acctually see those messages? <br><br>Please I need some advice on those two attempts.<br><br>Kindly regards,<br>Chris Hangi<br style="" class=""></span><div style="" class=""></div></div></body></html>