Re: [syslog-ng] Help: Meeting problems when writing to Oracle using syslog-ng 3.2.4

16 May 2011

      Hi,

                Anyone can help resolve this?

                I changed oracle database version from 10g to 11g.There's no
such error message appeared in the message log file,but no data was write
into the syslog table(the table can be created).

                Is there something wrong with my configuration?

                Thanks very much.

Best,

Henry

From: Henry Xu [mailto:bxu@italkbb.com] 
Sent: Saturday, May 14, 2011 10:45 PM
To: 'syslog-ng@lists.balabit.hu'
Subject: Help: Meeting problems when writing to Oracle using syslog-ng 3.2.4

Hi All,

                I am trying to use syslog-ng writing to Oracle directly.

                However,I encountered the following errors:

Error running SQL query; type='oracle', host='208.77.1.99', port='',
user='service0', database='XE', error='3113: OR

A-03113: end-of-file on communication channel\x0a', query='CREATE TABLE
syslog (datetime varchar2(16), hostname varchar2(32), app varchar2(32), pid
varchar2(

8), message varchar2(4000))'

                But when I checked the Oracle database,the table syslog
already created.I don't know why the syslog-ng gave such error message and
why it didn't write to Oracle using INSERT SQL.

                Here are my syslog-ng version info:

syslog-ng 3.2.4

Installer-Version: 3.2.4

Revision:
ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--
3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6

Compile-Date: May 13 2011 15:42:29

Enable-Threads: on

Enable-Debug: off

Enable-GProf: off

Enable-Memtrace: off

Enable-Sun-STREAMS: off

Enable-IPv6: on

Enable-Spoof-Source: on

Enable-TCP-Wrapper: on

Enable-SSL: on

Enable-SQL: on

Enable-Linux-Caps: off

Enable-Pcre: on

Enable-Pacct: off

                Here is my syslog-ng.conf content:

############################################################################
#

# Default syslog-ng.conf file which collects all local logs into a

# single file called /var/log/messages.

#

@version: 3.2

@include "scl.conf"

options {

        stats_freq(3600);

        keep_hostname(yes);

        flush_lines(16);

        log_fifo_size(16384);

};

source s_local {

        system();

        internal();

};

source s_network {

        udp();

};

destination d_local {

        file("/var/log/messages");

};

destination d_net {

        file("/var/log/syslog-ng_network");

};

destination d_oracle_syslog {

        sql(type(oracle)

            host("208.77.1.99")

            username("service0")

            password("acstest")

            database("XE")

            table("syslog")

            columns("datetime varchar2(16)",

                    "hostname varchar2(32)",

                    "app varchar2(32)",

                    "pid varchar2(8)",

                    "message varchar2(4000)")

            values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSG")

            indexes("datetime", "hostname", "app", "pid", "message")

        );

};

log {

        source(s_network);

        destination(d_net);

};

log {

        source(s_local);

        # uncomment this line to open port 514 to receive messages

        #source(s_network);

        destination(d_local);

};

#log {

#       source(s_network);

#       destination(d_oracle_syslog);

#};

source s_src {

        unix-stream("/dev/log");

        file("/proc/kmsg");

        internal();

};

log { source(s_src); destination(d_oracle_syslog); };

============================================================================
===============================

                Anyone can give some suggestions?

                Really appreciate your help!

Best,

Henry