[syslog-ng] Problem with sql destination
yavuz
sakncli at gmail.com
Thu Mar 18 15:42:30 CET 2010
Hi all,
I want to insert logs directly to mysql database,
I am using two destinations one is a file(for testing purposes) and the
second is sql. Logs are written to file but not sql destination. I couldn't
find the problem because don't know where to look.
The configuration file is attached.
thanks in advance.
// ps.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100318/c134228d/attachment.htm
-------------- next part --------------
@version:3.0
# This sample configuration file is essentially equilivent to the stock
# FreeBSD /etc/syslog.conf file.
#
#
# options
#
options { long_hostnames(off); flush_lines(0); };
#
# sources
#
source s_kvn {
unix-dgram("/usr/jails/node/var/run/logd");
unix-stream("/usr/jails/node/var/run/logs");
};
parser p_kvn_dns {
csv-parser(columns("KVN_DATE",
"KVN_SRC_IP",
"KVN_SRC_PORT",
"KVN_DST_IP",
"KVN_DST_PORT",
"KVN_EVENT",
"KVN_REQ",
"KVN_RESP")
flags(escape-double-char,strip-whitespace)
delimiters(" ")
quote-pairs('""[]')
);
};
#
# destinations
#
destination d_test_file { file("/var/log/messages",
template("INSERT INTO kvn_logs (program, date, src_ip, src_port, dst_ip, dst_port, event, request, response)
VALUES ('$PROGRAM','${KVN_DATE}','${KVN_SRC_IP}','${KVN_SRC_PORT}','${KVN_DST_IP}','${KVN_DST_PORT}','${KVN_EVENT}','${KVN_REQ}','${KVN_RESP}');\n")
);
};
destination d_kvn_sql { sql(type(mysql)
username("kvnlogger") password("xxxxx")
database("kovan")
table("kvn_logs")
columns("program varchar(64)",
"date datetime",
"src_ip varchar(256)",
"src_port int(11)",
"dst_ip varchar(256)",
"dst_port int(11)",
"event varchar(256)",
"request varchar(1024)",
"response varchar(1024)")
values( "$PROGRAM",
"${KVN_DATE}",
"${KVN_SRC_IP}",
"${KVN_SRC_PORT}",
"${KVN_DST_IP}",
"${KVN_DST_PORT}",
"${KVN_EVENT}",
"${KVN_REQ}",
"${KVN_RESP}")
indexes());
};
log {
source(s_kvn);
parser(p_kvn_dns);
destination(d_test_file);
destination(d_kvn_sql);
};
More information about the syslog-ng
mailing list