[syslog-ng] MySQL Pipe for Syslog-NG not working

[Clayton Dukes]

Ok, I'm back @ home. Here are a couple of suggestions:
Make sure you set DEBUG to TRUE in logzilla's config.php and restart syslog-ng
Check /var/log/logzilla/db_insert.log for an errors
Also, if you have the latest version of logzilla (v2.9.9n), there is a
selftest option of the db_insert.pl script, just run "./db_insert.pl
-s"

You may also find the following thread useful:
http://groups.google.com/group/php-syslog-ng-support/browse_thread/thread/aaeac90cbfde3210/75eed9d80a4ec2ba?lnk=gst&q=logzilla+is+empty&pli=1

If you are getting something like this:
"Can't connect to local MySQL server through socket
'/var/run/mysqld/mysqld.sock' (2)"

Then you will need to modify db_insert.pl and change the connect string to:
my $dbh = DBI->connect(
"DBI:mysql:$db:mysql_socket=/var/lib/mysql/mysql.sock", $dbuser,
$dbpass)

I don't know what's causing this, but only people running syslog-ng
v3.0 have reported it so far.

Please let me know if you get it working.
Also, to post to the php-syslog-ng list, please go here:
http://groups.google.com/group/php-syslog-ng-support


On Wed, Oct 28, 2009 at 6:29 PM, Patrick Smith <patrick at paypros.com> wrote:
> Hi, I realize this is a syslog-ng users list but I know many of you are
> using/developing php-syslog-ng/logzilla as well so I thought I’d post the
> question here.  I did a fresh install of syslog-ng on 3 servers, all running
> installed via rpm, but on one server the mysql pipe isn’t working
> successfully.
>
>
>
> 2 servers are 64-bit RHEL4, syslog-ng-3.0.4-1.el4 (rpm), remote MySQL
> community server (mysql pipe works)
>
> 1 is 64-bit RHEL5, syslog-ng-3.0.4-1.el5 (rpm), local RedHat MySQL server
> (mysql pipe is not inserting messages)
>
>
>
> The pipe is taken direct from the php-syslog-ng wiki installation guide:
>
>
>
> destination d_mysql {
>
>   program("/var/www/logzilla/scripts/db_insert.pl"
>
>
> template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n")
>
>   );
>
> };
>
>
>
> destination d_localfiles {
>
>         file("/var/log/syslog-ng/$HOST/$PROGRAM-$YEAR-$MONTH-$DAY.log");
>
> };
>
>
>
> log { source(s_remote); filter(f_allsystem); destination(d_mysql); };
>
> log { source(s_remote); filter(f_allsystem); destination(d_localfiles); };
>
>
>
> I have the same syslog-ng.conf file on all 3 hosts.  Everything seems to be
> working normally, the logs just aren’t making it into the RHEL5 mysql db.
>
> - Syslog messages are being received and written to local files.
>
> - Test access to mysql syslog DB as syslogadmin and sysloguser works fine.
> Correct passwds are in config file.
>
> - Test run of DBGen.pl works normally and the log messages are searchable in
> the logzilla UI.
>
> - No error messages in syslog-ng.log, mysqld.log, or logzilla logs.
>
>
>
> Any ideas as to how to further troubleshoot would be appreciated.
>
>
>
> IMPORTANT NOTICE
>
> THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are
> proprietary and confidential information intended only for the use of the
> recipient(s) named above. If you are not the intended recipient, you may not
> print, distribute, or copy this message or any attachments. If you have
> received this communication in error, please notify the sender by return
> e-mail and delete this message and any attachments from your computer. Learn
> more about Payment Processing's services at www.paypros.com.
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>



-- 
______________________________________________________________

Clayton Dukes
______________________________________________________________