[syslog-ng] Microsoft SQL connect issue

[Zoltán Pallagi]

Well, syslog-ng tries to query the result of "select * from tablename 
where 0=1;" to check if the specified table exists. If it didn't return 
with error, then the table exists, and syslog-ng will check the columns 
and alter the table if needed.
In other cases (the above query returned with any error), syslog-ng 
assumes that the specified table does not exist and tries to create it. 
As far as I see, this query returned with error in your case, that's the 
reason why syslog-ng tries to create it after reaching the next 
time_reopen. Also, it seems that syslog-ng has not enough permission to 
create this table. Are you sure that the user specified in syslog-ng 
conf has the sufficient permissions for this database?

You have just told me that you tried it with tsql, could you show me the 
output of this?
Have you used the same user? I mean you should execute tsql with the 
following parameters:
tsql -S rawsql -p 1785 -U user_in_conf -P password_in_conf

2010.12.13. 20:23 keltezéssel, Shawn Cannon írta:
> OK this is some good info.  It looks like even though I specify the 
> database name, it is someone how using it and tries to create or check 
> for the tables on the master database.  Any ideas?  Here is the info 
> from the capture.  Why is is running a SELECT looking for syslogng 
> instead of the database name?
>
> *....(....SELECT * FROM syslogng WHERE 0=1...K.<...7.........Invalid 
> object name 'syslogng'..RAWSQL\MARTY....................CREATE TABLE 
> syslogng (datetime varchar(16), host varchar(32), program varchar(32), 
> pid varchar(8), message varchar(4096))...`.<...L.......4.CREATE TABLE 
> permission denied in database 'master'..RAWSQL\MARTY............
> *
> Here is my destination section from my syslogng config:
>
> destination d_mssql {
> sql(type(mssql) host("rawsql") port("1785")
> username("*******") password("*******") database("Database")
> table("syslogng")columns("datetime varchar(16)", "host varchar(32)",
> "program varchar(32)", "pid varchar(8)", "message varchar(4096)")
> values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY")
> indexes("datetime", "host", "program", "pid"));
> };
>
>
> Shawn Cannon
>
> IT Professional
>
> http://www.shawncannon.com <http://www.shawncannon.com/>
>
> Contact Me <http://www.linkedin.com/pub/shawn-cannon/5/84/81a> 
> LinkedIn <http://www.linkedin.com/pub/shawn-cannon/5/84/81a> 
> <http://www.facebook.com/rolltidega72> Facebook 
> <http://www.facebook.com/rolltidega72> <http://twitter.com/rolltidega> 
> Twitter <http://twitter.com/rolltidega>
> My blog: My thoughts on VMworld… a week later… 
> <http://www.shawncannon.com/?p=19>
>
>
>
> On Mon, Dec 13, 2010 at 1:45 PM, Shawn Cannon <shawn at shawncannon.com 
> <mailto:shawn at shawncannon.com>> wrote:
>
>     Would it help if I posted the syntax of my config file?
>
>
>     Shawn Cannon
>
>     IT Professional
>
>     http://www.shawncannon.com <http://www.shawncannon.com/>
>
>     Contact Me <http://www.linkedin.com/pub/shawn-cannon/5/84/81a>
>     LinkedIn <http://www.linkedin.com/pub/shawn-cannon/5/84/81a>
>     <http://www.facebook.com/rolltidega72> Facebook
>     <http://www.facebook.com/rolltidega72>
>     <http://twitter.com/rolltidega> Twitter
>     <http://twitter.com/rolltidega>
>     My blog: My thoughts on VMworld… a week later…
>     <http://www.shawncannon.com/?p=19>
>
>
>
>     On Mon, Dec 13, 2010 at 1:17 PM, Matthew Hall
>     <mhall at mhcomputing.net <mailto:mhall at mhcomputing.net>> wrote:
>
>         On Mon, Dec 13, 2010 at 12:19:03PM -0500, Shawn Cannon wrote:
>         > I meant I ran tsql.  :-)
>         >
>         > Shawn Cannon
>         >
>         > IT Professional
>         >
>         > > OK I installed it ans ran TDS using sql.hidden.local and
>         the port number
>         > > and I was able to create the table.  I changed my syslogng
>         config file to
>         > > this same setting, yet it still gives me an error.  I left
>         the table in the
>         > > database that was created but even that did not help.  Any
>         ideas?
>
>         There have been some bugs in the past where syslog-ng was not
>         always
>         connecting to the database correctly on the proper ports, etc.
>         However
>         in your case this could only apply if something was also
>         listening on
>         the default port I would assume, since it seemed like it had
>         connected.
>         Although as one of the other posters had pointed out there
>         could be an
>         inaccurate error message as well. Perhaps you could verify it's
>         connecting properly to the DB using Wireshark?
>
>         Was the tsql / sqsh / etc. based testing performed using the same
>         machine as the syslog-ng setup is running?
>
>         Matthew.
>         ______________________________________________________________________________
>         Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>         Documentation:
>         http://www.balabit.com/support/documentation/?product=syslog-ng
>         FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>


-- 
pzolee
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20101213/afd41a88/attachment.htm