Re: [syslog-ng]Can't get pipe working

2 Jul 2004

      Hi Clayton,

wie use ist in slyghtly other way and it writes several gigabytes per dy in our mysql database.

1) the syslog-ng configuration

destination d_ToSysLogDB {
  pipe("/tmp/syslog.pipe"
  owner("root")
  group("root")
  perm(0640)
  template("insert into syslog(host,facility,priority,level,tag,date,time,progra
m,msg) values ('$HOST','$FACILITY', '$PRIORITY', '$LEVEL', '$TAG','$YEAR-$MONTH-
$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes));
};

log { source(loghost); destination(d_ToSysLogDB); };

2) there is a script running that takes the data from the pipe and writes them into the databse

#!/bin/bash
#
if [ -e /tmp/syslog.pipe ]; then
  while [ -e /tmp/syslog.pipe ]
    do
      mysql -u syslog --password=<password> syslog -h syslog < /tmp/syslog.pipe
  done
else
  mkfifo /tmp/syslog.pipe
  while [ -e /tmp/syslog.pipe ]
    do
      mysql -u syslog --password=<password> -h syslog < /tmp/syslog.pipe
  done
fi

3) Keep in mind that a tail -f on a pipe will take all data out of the pipe and you cannot write them into a database.

Stephan

Dr. Stephan Hendl
Systemmanagement
-----------------------------------
Landesbetrieb für
Datenverarbeitung und Statistik
Land Brandenburg

Adresse: 14467 Potsdam, Dortustr. 46
Telefon: +49-(0)331 39-471
Fax: +49-(0)331 27548-1187
Mobil: +49-(0)160 90 645 893
EMail: Stephan.Hendl@lds.brandenburg.de 
Internet: http://www.lds-bb.de
...
...
...
cdukes@cdukes.com 01.07.2004 20:02:57 >>>
Hi all,
I seem to be having trouble getting a mysql pipe working and thought I would
enlist your help.
Here's my config:

options { use_fqdn(no);
          keep_hostname(yes);
          use_dns(no);
          long_hostnames(off);
          sync(0);
          log_fifo_size(1000);

        # The default action of syslog-ng 1.6.0 is to log a STATS line
        # to the file every 10 minutes.  That's pretty ugly after a while.
        # Change it to every 12 hours so you get a nice daily update of
        # how many messages syslog-ng missed (0).
        stats(43200);
};

############################
# Set up Sources
############################
source src { unix-dgram("/dev/log"); internal(); };
source net { udp(); };
source s_jffnms { unix-dgram("/dev/log"); internal(); udp(); };

# MySQL Logs

destination d_jffnms {
  pipe("/tmp/mysql.pipe"
    template("INSERT INTO syslog (date, date_logged, host, message) VALUES
('$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', NOW\(\), '$FULLHOST', '$MSG');\n")
template-escape(yes));
    };
destination jffnms_processing {
      program ("mysql -u jffnms -pjffnms jffnms < /tmp/mysql.pipe"); };

log {
       source (s_jffnms);
       #filter (f_jffnms);   #if you use it
       destination (d_jffnms);
};

# End
When I restart syslog-ng and tail -f /tmp/mysql.pipe nothing comes in (nor
are there any database inserts happening).
When I do a tcpdump, I do see the event coming into my server, but it seems
as though syslog-ng is just dropping the packet...?

Regards,
Clayton Dukes
CCNA, CCDA, CCNP, CCDP
Sr. Network Engineer
E Solutions Corp.
http://www.esnet.com 
813.301.2620 (o)
813.545.7373 (c)

_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu 
https://lists.balabit.hu/mailman/listinfo/syslog-ng 
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html