[syslog-ng] syslog + snare + mysql

Eli Robinson Eli.Robinson at thielekaolin.com
Thu Nov 20 22:12:03 CET 2008

Hello all!

I am currently running the following:

Syslog-ng 2.0.5 on FC8, kernel, no firewall, SELinux
disabled, logging to mysql 5.0.45 via a named pipe
Snare 2.6.1 on Windows Server 2003 with the enable syslog header option

The Snare clients have been running for several years and were
communicating with an older version of snare. Everything logged
perfectly. Unfortunately a hardware failure caused loss of the config
file and old syslog server, so I do not have the configuration or
version which worked. My setup notes reference a howto online, which I
followed again. 

I use the following destination to log to mysql

destination d_mysql {
 template("INSERT INTO logs (host, facility, priority, level, tag, date,
 time, program, msg, username) VALUES ( '$HOST', '$FACILITY',
'$USERNAME' );\n") template-escape(yes));

And also this collector script to run the actual mysql client:


if [ -e /tmp/mysql.pipe ]; then
while [ -e /tmp/mysql.pipe ]
mysql -u syslogusername --password=syslogpassword syslog <
mkfifo /tmp/mysql.pipe

I use out of the box filters and destinations to log to the messages
logfile (for debugging at this point)

My problem arises from the fact that for this entry in my messages file:

Nov 20 16:01:14 testserver.mydomain.com FTPSvcLog	3	21:01:11 [36863]created /index.htm 226 0

I only get 'FTPsvcLog' written to the messages field in mysql.

I am pretty sure its something obviously wrong but at this point I need
another set of eyes. My gut feeling is the issue stems from the tabs
following FTPSvcLog and the number 3. Any thoughts? Thanks in advance!


More information about the syslog-ng mailing list