[syslog-ng]Can't get pipe working
Clayton Dukes
syslog-ng@lists.balabit.hu
Thu, 1 Jul 2004 14:02:57 -0400
Hi all,
I seem to be having trouble getting a mysql pipe working and thought I would
enlist your help.
Here's my config:
options { use_fqdn(no);
keep_hostname(yes);
use_dns(no);
long_hostnames(off);
sync(0);
log_fifo_size(1000);
# The default action of syslog-ng 1.6.0 is to log a STATS line
# to the file every 10 minutes. That's pretty ugly after a while.
# Change it to every 12 hours so you get a nice daily update of
# how many messages syslog-ng missed (0).
stats(43200);
};
############################
# Set up Sources
############################
source src { unix-dgram("/dev/log"); internal(); };
source net { udp(); };
source s_jffnms { unix-dgram("/dev/log"); internal(); udp(); };
# MySQL Logs
destination d_jffnms {
pipe("/tmp/mysql.pipe"
template("INSERT INTO syslog (date, date_logged, host, message) VALUES
('$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', NOW\(\), '$FULLHOST', '$MSG');\n")
template-escape(yes));
};
destination jffnms_processing {
program ("mysql -u jffnms -pjffnms jffnms < /tmp/mysql.pipe"); };
log {
source (s_jffnms);
#filter (f_jffnms); #if you use it
destination (d_jffnms);
};
# End
When I restart syslog-ng and tail -f /tmp/mysql.pipe nothing comes in (nor
are there any database inserts happening).
When I do a tcpdump, I do see the event coming into my server, but it seems
as though syslog-ng is just dropping the packet...?
Regards,
Clayton Dukes
CCNA, CCDA, CCNP, CCDP
Sr. Network Engineer
E Solutions Corp.
http://www.esnet.com
813.301.2620 (o)
813.545.7373 (c)