[syslog-ng] Help with db_parser()

[Matthew Hall]

On Thu, Dec 16, 2010 at 07:55:54PM +0100, Giovanni Mancuso wrote:
> If i run syslog-ng with debug, i see that the version that is: 3.1.3 and
> i hve the warning:
> 
> WARNING: You are using the default values for columns(), indexes() or
> values(), please specify these explicitly as the default will be dropped
> in the future;

Probably a good idea to fix whatever is causing it in your sql setup.

> Running SQL query; query='SELECT * FROM mcslogin WHERE 0=1'
> Running SQL query; query='INSERT INTO mcslogin (date, loginuser,
> ipsource) VALUES (\'2010-12-16 18:59:05\', \'\', \'\')'

It appears your sql setup is inserting empty values to your tables. So 
probably the variables did not get filled in right. Try logging output 
to a text file using a rewrite or template that prints out the variables 
to be sure they work and get filled in. Here's an example of a template 
to use for an output file:

template t_welf {
    template("time=\"$R_DATE\" fw=\"$HOST\" pri=\"$LEVEL_NUM\" foo=\"$bar\"\n");
    template_escape(no);
};

If you log to an output file using a template like this, you can see if 
your variables are getting filled in properly by the patterndb.

Matthew.