[syslog-ng] Microsoft SQL connect issue

Mon Dec 13 23:04:07 CET 2010

The only thing that I did not have selected for the sql user was to default
it to the database I wanted to use.  It defaulted to Master.  I changed that
and now all is well.  Kinda strange to have an option called database() if
it does not use that.

Shawn Cannon

IT Professional

http://www.shawncannon.com

Contact Me <http://www.linkedin.com/pub/shawn-cannon/5/84/81a>
LinkedIn<http://www.linkedin.com/pub/shawn-cannon/5/84/81a>
<http://www.facebook.com/rolltidega72>
Facebook<http://www.facebook.com/rolltidega72>
<http://twitter.com/rolltidega> Twitter <http://twitter.com/rolltidega>
My blog: My thoughts on VMworld… a week later…<http://www.shawncannon.com/?p=19>

On Mon, Dec 13, 2010 at 4:29 PM, Zoltán Pallagi <pzolee at balabit.hu> wrote:

>  Well, syslog-ng tries to query the result of "select * from tablename
> where 0=1;" to check if the specified table exists. If it didn't return with
> error, then the table exists, and syslog-ng will check the columns and alter
> the table if needed.
> In other cases (the above query returned with any error), syslog-ng assumes
> that the specified table does not exist and tries to create it. As far as I
> see, this query returned with error in your case, that's the reason why
> syslog-ng tries to create it after reaching the next time_reopen. Also, it
> seems that syslog-ng has not enough permission to create this table. Are you
> sure that the user specified in syslog-ng conf has the sufficient
> permissions for this database?
>
> You have just told me that you tried it with tsql, could you show me the
> output of this?
> Have you used the same user? I mean you should execute tsql with the
> following parameters:
> tsql -S rawsql -p 1785 -U user_in_conf -P password_in_conf
>
> 2010.12.13. 20:23 keltezéssel, Shawn Cannon írta:
>
> OK this is some good info.  It looks like even though I specify the
> database name, it is someone how using it and tries to create or check for
> the tables on the master database.  Any ideas?  Here is the info from the
> capture.  Why is is running a SELECT looking for syslogng instead of the
> database name?
>
> *....(....SELECT * FROM syslogng WHERE 0=1...K.<...7.........Invalid
> object name 'syslogng'..RAWSQL\MARTY....................CREATE TABLE
> syslogng (datetime varchar(16), host varchar(32), program varchar(32), pid
> varchar(8), message varchar(4096))...`.<...L.......4.CREATE TABLE permission
> denied in database 'master'..RAWSQL\MARTY............
> *
> Here is my destination section from my syslogng config:
>
> destination d_mssql {
> sql(type(mssql) host("rawsql") port("1785")
> username("*******") password("*******") database("Database")
> table("syslogng")columns("datetime varchar(16)", "host varchar(32)",
> "program varchar(32)", "pid varchar(8)", "message varchar(4096)")
> values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY")
> indexes("datetime", "host", "program", "pid"));
> };
>
>
>   Shawn Cannon
>
> IT Professional
>
> http://www.shawncannon.com
>
>
>  Contact Me <http://www.linkedin.com/pub/shawn-cannon/5/84/81a> LinkedIn<http://www.linkedin.com/pub/shawn-cannon/5/84/81a>
> <http://www.facebook.com/rolltidega72> Facebook<http://www.facebook.com/rolltidega72>
> <http://twitter.com/rolltidega> Twitter <http://twitter.com/rolltidega>
> My blog: My thoughts on VMworld… a week later…<http://www.shawncannon.com/?p=19>
>
>
>
> On Mon, Dec 13, 2010 at 1:45 PM, Shawn Cannon <shawn at shawncannon.com>wrote:
>
>> Would it help if I posted the syntax of my config file?
>>
>>
>>   Shawn Cannon
>>
>> IT Professional
>>
>> http://www.shawncannon.com
>>
>>
>>  Contact Me <http://www.linkedin.com/pub/shawn-cannon/5/84/81a> LinkedIn<http://www.linkedin.com/pub/shawn-cannon/5/84/81a>
>> <http://www.facebook.com/rolltidega72> Facebook<http://www.facebook.com/rolltidega72>
>> <http://twitter.com/rolltidega> Twitter <http://twitter.com/rolltidega>
>> My blog: My thoughts on VMworld… a week later…<http://www.shawncannon.com/?p=19>
>>
>>
>>
>>   On Mon, Dec 13, 2010 at 1:17 PM, Matthew Hall <mhall at mhcomputing.net>wrote:
>>
>>> On Mon, Dec 13, 2010 at 12:19:03PM -0500, Shawn Cannon wrote:
>>> > I meant I ran tsql.  :-)
>>> >
>>> > Shawn Cannon
>>> >
>>> > IT Professional
>>> >
>>>  > > OK I installed it ans ran TDS using sql.hidden.local and the port
>>> number
>>> > > and I was able to create the table.  I changed my syslogng config
>>> file to
>>> > > this same setting, yet it still gives me an error.  I left the table
>>> in the
>>> > > database that was created but even that did not help.  Any ideas?
>>>
>>>  There have been some bugs in the past where syslog-ng was not always
>>> connecting to the database correctly on the proper ports, etc. However
>>> in your case this could only apply if something was also listening on
>>> the default port I would assume, since it seemed like it had connected.
>>> Although as one of the other posters had pointed out there could be an
>>> inaccurate error message as well. Perhaps you could verify it's
>>> connecting properly to the DB using Wireshark?
>>>
>>> Was the tsql / sqsh / etc. based testing performed using the same
>>> machine as the syslog-ng setup is running?
>>>
>>> Matthew.
>>>
>>> ______________________________________________________________________________
>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>> Documentation:
>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>> FAQ: http://www.campin.net/syslog-ng/faq.html
>>>
>>>
>>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>
> --
> pzolee
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20101213/09b414b6/attachment-0001.htm 