<div dir="ltr">Hello,<div><br></div><div>I tried your config on ubuntu:16.04 where I've found 3.5.6-2.1 [@416d315]. The mysql was the latest mysql docker image in dockerhub.</div><div><br></div><div>It create a new table, and push the message into the table; but not at the first time. When it tried to create a table instrumenting with index, "Error running SQL query; type='mysql', host='127.0.0.1', port='', user='root', database='syslog', error='1170: BLOB/TEXT column \'date\' used in key specification without a key length', query='CREATE INDEX messages_peterkokai_work_date_idx ON messages_peterkokai_work (date)'"</div><div><br></div><div>It creates the fields of the table as TEXT, which cannot be index by default.</div><div><br></div><div>What distro are you using ? Where do you get the syslog-ng ? Would it be possible to try with the latest ?</div><div><br></div><div>--</div><div>Kokan</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 16, 2019 at 5:27 PM N. Max Pierson <<a href="mailto:nmaxpierson@gmail.com">nmaxpierson@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Thanks for all of the feedback Peter.<div><br></div><div>I have resolved all of the issues I was having and it turns out I did not have the specific mysql libdbi driver installed which was causing the error. Now that it is resolved, I am having one last issue. When I enable the log statement with the sql destination in it, nothing is being written to the database. I'm not getting any errors as to why and I know the source and filter/rewrite is working because if I log it to a flat file it works correctly. My config for the sql destination is below, so my questions are ....</div><div><br></div><div>The docs state that the tables and columns can be dynamically created if I use macros, but that doesn't happen with the config below. Is that correct for version 3.5 that I am using? Is this config correct and is there any logs or flags I can use to see why the tables and columns aren't being created dynamically? I also created them manually and it still doesn't insert the record either.</div><div><br></div><div>source s_network { udp(ip(0.0.0.0) port(514)); };<br></div><div><br></div><div>filter f_nexus { host("10.251.11.241"); };<br></div><div><br></div><div>rewrite r_nexus{ subst("^[a-z]+ [0-9]+ [0-9]+:[0-9]+:[0-9]+ [a-z]+: ", "", value("MESSAGE"), type("posix"), flags("ignore-case"), condition(filter(f_nexus))); };<br></div><div><br></div><div></div></div></div></div></div></div></div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div>destination d_mysql {</div><div> sql(type(mysql)</div><div> host("127.0.0.1")</div><div> username("syslog-ng")</div><div> password("password")</div><div> database("syslog")</div><div> table("messages_${HOST}")</div></div></div></div></div></div></div></div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div> columns("date", "host", "level", "message")</div><div> values("${R_DATE}", "${HOST}", "${LEVEL}", "${MESSAGE}")</div><div> indexes("date", "host", "level") );</div><div>};</div></div><div><br></div><div>log { source(s_network); rewrite(r_nexus); destination(d_mysql); };<br></div><div><br></div><div>Thanks again for the help!!</div><div><br></div><div>Regards,</div><div>Max</div></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Wed, Jan 16, 2019 at 12:18 AM Péter, Kókai <<a href="mailto:peter.kokai@oneidentity.com" target="_blank">peter.kokai@oneidentity.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hello,<div><br></div><div>Please do that :) I was not on board of the project at version 3.5</div><div><br></div><div>Well a macro itself also a template, a template somewhat more generic as that include string literals, template functions and of course macros, and those combination.</div><div><br></div><div>In order to cut the date part; there was just recently a nice patch that did similar thing for websense-parser: <a href="https://github.com/balabit/syslog-ng/pull/2471/commits/a725a578b06459e96a3bc85812e12a71d3f0a3b4" target="_blank">https://github.com/balabit/syslog-ng/pull/2471/commits/a725a578b06459e96a3bc85812e12a71d3f0a3b4</a></div><div><br></div><div>Also for example the cisco-parser has tricks you can learn from: <a href="https://github.com/balabit/syslog-ng/blob/master/scl/cisco/plugin.conf" target="_blank">https://github.com/balabit/syslog-ng/blob/master/scl/cisco/plugin.conf</a></div><div><br></div><div><div><br></div><div>--</div><div>Kokan</div></div></div><br><div class="gmail_quote"><div dir="ltr" class="m_-5305961665079065281gmail-m_6242035013209997651gmail_attr">On Tue, Jan 15, 2019 at 8:16 PM N. Max Pierson <<a href="mailto:nmaxpierson@gmail.com" target="_blank">nmaxpierson@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Thanks for the reply.<div><br></div><div>I am using version 3.5, so I am reading the admin guide for 3.5 now to see if I have something configured that isn't available in this version.</div><div><br></div><div>As far as the template, I thought the ${R_DATE} was a macro. Maybe I am misunderstanding then. What I need is to take a part of the log that comes in and remove it. Here is a sample of the message I have below. What is the best way to remove the date portion that isn't part of the standard syslog message ( the part delimited by ***).</div><div><br></div><div>Jan 15 13:12:35 10.251.11.241 ***2019 Jan 15 13:12:35 CST:*** %DAEMON-3-SYSTEM_MSG: NTP Receive dropping message: Received NTP control mode packet. Drop count:147908 - ntpd[15029]<br></div><div><br></div><div>Regards,</div><div>Max</div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Jan 15, 2019 at 12:03 AM Péter, Kókai <<a href="mailto:peter.kokai@oneidentity.com" target="_blank">peter.kokai@oneidentity.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hello,<div><br></div><div>As the *--syntax-only* suggest, it only does check for syntactic errors.</div><div>A common way to find such issues to start the process in foreground:</div><div>* stop syslog-ng systemd service (so it won't get in the way)</div><div>* start syslog-ng as the systemd would do, plus include the -F (foreground) option and -e (print internal logs to the stderr); optionally you may also use -d (debug) -v (verbose); but in this case probably the -Fe would suffice</div><div><br></div><div>I just tried your config (with additional @version: 3.18), and it started just fine.</div><div><br></div><div>About the second part. You already using template in your configuration for the date column ( ${R_DATE} ); in the values you should be able to use any template (not template function due).</div><div><br></div><div>--</div><div>Kokan</div></div><br><div class="gmail_quote"><div dir="ltr" class="m_-5305961665079065281gmail-m_6242035013209997651m_-4189799920579746805gmail-m_762510991354689602gmail_attr">On Mon, Jan 14, 2019 at 10:54 PM N. Max Pierson <<a href="mailto:nmaxpierson@gmail.com" target="_blank">nmaxpierson@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Hi List,<div><br></div><div>I have 2 questions about the sql driver. First, I am trying to get messages into sql using the sql driver but I get an error when I try and restart syslog-ng when I enable the log statement with the sql destination. The syslog-ng --syntax-only command runs without any issues but systemd throws and error that it cannot restart the service but doesn't give a clear reason. My config is below, doesn't anyone know where in a log I can see why it won't restart??</div><div><br></div><div>source s_network { udp(ip(0.0.0.0) port(514)); };<br></div><div><br></div><div><div>destination d_mysql {</div><div> sql(type(mysql)</div><div> host("127.0.0.1")</div><div> username("syslog-ng")</div><div> password("password")</div><div> database("syslog")</div><div> table("messages_${HOST}")</div><div> columns("date", "host", "message")</div><div> values("${R_DATE}", "${HOST}", "${MESSAGE}")</div><div> indexes("date", "host") );</div><div>};</div></div><div><br></div><div>log { source(s_network); destination(d_mysql); };<br></div><div><br></div><div><br></div><div>My second question is can you use a template with the sql destination driver? I need to reformat some Cisco Nexus logs because of how it formats the date (looks to be non RFC compliant) and if so, can someone give me a sample of config with the template in the sql destination driver? I cannot seem to find in the docs if this is even possible much less and example of how to do it.</div><div><br></div><div>TIA,</div><div>Max</div></div></div></div></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>