Well, syslog-ng tries to query the result of "select * from tablename where 0=1;" to check if the specified table exists. If it didn't return with error, then the table exists, and syslog-ng will check the columns and alter the table if needed.
In other cases (the above query returned with any error), syslog-ng assumes that the specified table does not exist and tries to create it. As far as I see, this query returned with error in your case, that's the reason why syslog-ng tries to create it after reaching the next time_reopen. Also, it seems that syslog-ng has not enough permission to create this table. Are you sure that the user specified in syslog-ng conf has the sufficient permissions for this database?

You have just told me that you tried it with tsql, could you show me the output of this?
Have you used the same user? I mean you should execute tsql with the following parameters:
tsql -S rawsql -p 1785 -U user_in_conf -P password_in_conf

2010.12.13. 20:23 keltezéssel, Shawn Cannon írta:
OK this is some good info.  It looks like even though I specify the database name, it is someone how using it and tries to create or check for the tables on the master database.  Any ideas?  Here is the info from the capture.  Why is is running a SELECT looking for syslogng instead of the database name?

....(....SELECT * FROM syslogng WHERE 0=1...K.<...7.........Invalid object name 'syslogng'..RAWSQL\MARTY....................CREATE TABLE syslogng (datetime varchar(16), host varchar(32), program varchar(32), pid varchar(8), message varchar(4096))...`.<...L.......4.CREATE TABLE permission denied in database 'master'..RAWSQL\MARTY............

Here is my destination section from my syslogng config:

destination d_mssql {
sql(type(mssql) host("rawsql") port("1785")
username("*******") password("*******") database("Database")
table("syslogng")columns("datetime varchar(16)", "host varchar(32)",
"program varchar(32)", "pid varchar(8)", "message varchar(4096)")
values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY")
indexes("datetime", "host", "program", "pid"));
};


Shawn Cannon

IT Professional

http://www.shawncannon.com

 

Contact Me LinkedIn Facebook Twitter
My blog: My thoughts on VMworld… a week later…



On Mon, Dec 13, 2010 at 1:45 PM, Shawn Cannon <shawn@shawncannon.com> wrote:
Would it help if I posted the syntax of my config file?





On Mon, Dec 13, 2010 at 1:17 PM, Matthew Hall <mhall@mhcomputing.net> wrote:
On Mon, Dec 13, 2010 at 12:19:03PM -0500, Shawn Cannon wrote:
> I meant I ran tsql.  :-)
>
> Shawn Cannon
>
> IT Professional
>
> > OK I installed it ans ran TDS using sql.hidden.local and the port number
> > and I was able to create the table.  I changed my syslogng config file to
> > this same setting, yet it still gives me an error.  I left the table in the
> > database that was created but even that did not help.  Any ideas?

There have been some bugs in the past where syslog-ng was not always
connecting to the database correctly on the proper ports, etc. However
in your case this could only apply if something was also listening on
the default port I would assume, since it seemed like it had connected.
Although as one of the other posters had pointed out there could be an
inaccurate error message as well. Perhaps you could verify it's
connecting properly to the DB using Wireshark?

Was the tsql / sqsh / etc. based testing performed using the same
machine as the syslog-ng setup is running?

Matthew.
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html




______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html


--
pzolee