Syslog-NG/MySQL question
Here is the output of /opt/syslog-ng/sbin/syslog-ng -V: [root@ustc-syslog2 ~]# /opt/syslog-ng/sbin/syslog-ng -V syslog-ng-premium-edition 4 F2 (4.2.3) Installer-Version: 4.2.3 Revision: ssh+git://folti@git.balabit//var/scm/git/syslog-ng/syslog-ng-core--mainline- -4.2#master#725fff94b398b564b71f9de88808148b0dd2fc8d Compile-Date: Jul 4 2012 14:01:24 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat,afl ogstore,disk-buffer,confighash,convertfuncs,basic-proto,rltp-proto,afsql,afs qlsource Available-Modules: afsql,license,afsocket-tls,afuser,tfjson,csvparser,affile,dbparser,rltp-prot o,afsocket-notls,dummy,confgen,aflogstore,basicfuncs,basic-proto,afsqlsource ,snmp,afsocket,syslogformat,disk-buffer,afprog,convertfuncs Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-Linux-Caps: on Enable-Pcre: on Does anyone know what needs to be edited/installed to have the line "Enable-SQL: on" be included in that output? I installed the following MySQL rpms on this server but I'm not sure what else needs to be done to have that line appear. MySQL-client-5.5.14-1.rhel5.x86_64.rpm MySQL-server-5.5.14-1.rhel5.x86_64.rpm MySQL-shared-compat-5.5.14-1.rhel5.x86_64.rpm MySQL-devel-5.5.14-1.rhel5.x86_64.rpm MySQL-shared-5.5.14-1.rhel5.x86_64.rpm MySQL-test-5.5.14-1.rhel5.x86_64.rpm Thanks, James McDonald System Administrator RHCSA, Security+ jmcdonald@lce.com
James McDonald <jmcdonald@LCE.com> writes:
[root@ustc-syslog2 ~]# /opt/syslog-ng/sbin/syslog-ng -V [...] Available-Modules: afsql,license,afsocket-tls,afuser,tfjson,csvparser,affile,dbparser,rltp-prot o,afsocket-notls,dummy,confgen,aflogstore,basicfuncs,basic-proto,afsqlsource ,snmp,afsocket,syslogformat,disk-buffer,afprog,convertfuncs [...]
Does anyone know what needs to be edited/installed to have the line "Enable-SQL: on" be included in that output?
"Enable-SQL: on" will never appear there, because SQL support is done entirely by the 'afsql' module (which is listed in the Available-Modules, all versions of syslog-ng PE ship with it). The "Enable-*" flags in that output are all things that modify the behaviour or feature-set of either the core program, or of a module. None of them are completely independently implemented, therefore they're displayed. SQL support is a separate module, so it is not. syslog-ng PE binaries ship with everything needed (on the syslog-ng side) for SQL support. In previous versions of syslog-ng PE (4.0 and before), where SQL support was not a module, but part of the core application like everything else, the Enable-SQL thing made sense. With 4.1, this was removed, and replaced by the afsql module. If you have further questions regarding PE's SQL support, the guys at support@balabit.com will gladly help ;) -- |8]
Thanks for the response. I guess that means I was looking at older instructions for how to integrate MySQL and Syslog-NG. I am having trouble getting syslog-ng to send logs to a MySQL db. Have you ever done this? Could you try to help me figure out why I can't get syslog-ng and MySQL to communicate? I can send any info that you may need to help. -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Gergely Nagy Sent: Thursday, September 06, 2012 9:19 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-NG/MySQL question James McDonald <jmcdonald@LCE.com> writes:
[root@ustc-syslog2 ~]# /opt/syslog-ng/sbin/syslog-ng -V [...] Available-Modules: afsql,license,afsocket-tls,afuser,tfjson,csvparser,affile,dbparser,rlt p-prot o,afsocket-notls,dummy,confgen,aflogstore,basicfuncs,basic-proto,afsql source ,snmp,afsocket,syslogformat,disk-buffer,afprog,convertfuncs [...]
Does anyone know what needs to be edited/installed to have the line "Enable-SQL: on" be included in that output?
"Enable-SQL: on" will never appear there, because SQL support is done entirely by the 'afsql' module (which is listed in the Available-Modules, all versions of syslog-ng PE ship with it). The "Enable-*" flags in that output are all things that modify the behaviour or feature-set of either the core program, or of a module. None of them are completely independently implemented, therefore they're displayed. SQL support is a separate module, so it is not. syslog-ng PE binaries ship with everything needed (on the syslog-ng side) for SQL support. In previous versions of syslog-ng PE (4.0 and before), where SQL support was not a module, but part of the core application like everything else, the Enable-SQL thing made sense. With 4.1, this was removed, and replaced by the afsql module. If you have further questions regarding PE's SQL support, the guys at support@balabit.com will gladly help ;) -- |8] ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
James McDonald <jmcdonald@LCE.com> writes:
Thanks for the response. I guess that means I was looking at older instructions for how to integrate MySQL and Syslog-NG. I am having trouble getting syslog-ng to send logs to a MySQL db. Have you ever done this? Could you try to help me figure out why I can't get syslog-ng and MySQL to communicate? I can send any info that you may need to help.
Well, I used an SQL destination only briefly, and that was years ago, but I believe the documentation was fairly good, and even had examples. For example: http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guide... I believe that's a fairly complete one with quite a lot of options set and all that. As to why it doesn't communicate, the debug logs should tell you a lot. It can be anything from MySQL not listening to TCP (and thus syslog-ng can't connect) through firewall issues to tables not insufficient permissions. Run syslog-ng with -Fvde, it will tell you which SQL commands failed and why. It should also tell you why it could not connect, which, at worst, will give you a hint. At the same time, looking at the mysql logs could reveal the issue aswell. And again, BalaBit support is happy to help with PE-related issues, they can help you further in this case too. -- |8]
participants (2)
-
Gergely Nagy
-
James McDonald