[syslog-ng] syslog-ng and oracle

Balazs Scheidler bazsi at balabit.hu
Wed Aug 12 09:48:16 CEST 2009


On Tue, 2009-08-11 at 22:33 +0200, Andreas Sartori wrote:
> hello,
> 
> we are currently setting up a new syslog server and switching from a sun
> fire v880 with syslog-ng and plain files
> to a new linux based (centos 5.3) syslog server with oracle as logging
> backend.
> 
> we do not want to use pipes to write to the database, so we compiled
> libdbi-dbd-oracle with the oracle instantclient 10.2.0.4-1.
> 
> syslog-ng is starting up fine (not complaining about the oracle backend),
> but we do have some problem with
> the inserts to the database.
> 
> 
> our trial syslog-ng configuration:
> 
> destination d_sql_fwint {
> sql(type(oracle)
> username("xxx") password("xxx")
> database("dashb")
> table("SYSLOG_FWINT")
> columns("MSG_RCV_TIME varchar2(16)", "HOSTNAME varchar2(256)", "MESSAGE
> varchar2(2048)")
> values("$R_DATE", "$HOST", "$MSGONLY")
> };
> 
> when running in debug mode we get the following output:
>  Running SQL query; query='INSERT INTO SYSLOG_FWINT (MSG_RCV_TIME,
> HOSTNAME, MESSAGE) VALUES (\'Aug 11 21:24:14\', \'gw20\', \'Built
> outbound TCP connection 144547326429398234 for LAN230:10.20.30.17/43825
> (10.20.30.17/43825) to outside:10.10.10.102/80 (10.10.10.102/80)\')'
> 

the backslash only comes to the console log (to escape the
starting/ending quotes of the query='' tag of the log message) and is
not included in the query as posted to Oracle.

Hmm.. hmm, now as I think of it I had to patch the libdbi Oracle driver
to make that work to auto-commit INSERTs, because by default oracle does
not commit automatically.

I've submitted those patches to upstream libdbi-drivers and seem to be
included in the CVS repository, although I'm not sure if there was a
release since then.

Which libdbi-drivers version are you using? Can you try using their CVS
version?

> this cant work sind oracle is not accepting \ as escape char, and in this
> case we do not need an escape at all. the
> sql syntax is right without the \.
> 
> since templates are not working when using the sql driver, does anyone has
> an idea how to fix that?
> are we missing something?
> 
> oracle setup is right, tnsnames or works and we can connect to the
> database with sqlplus. the syslog-ng init script
> as the environment variables set (ORACLE_HOME, LD_LIBRARY_PATH)
> 
> thanks for any help
> 
> -andy
> 
> 
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
> 
> 
-- 
Bazsi




More information about the syslog-ng mailing list