MonitorWare Knowledge Base

root@linux:/var/log# tail -f winsyslog-like.log
linux,2005-10-21,11:36:25,2005-10-21,11:36:25,5,3,rsyslogd: db error (2003): Can't connect to MySQL server on '127.0.0.1' (11
1)

linux,2005-10-21,11:36:25,2005-10-21,11:36:25,5,3,rsyslogd: db error (2003): Can't connect to MySQL server on '127.0.0.1' (11
1)

linux,2005-10-21,11:36:25,2005-10-21,11:36:25,5,3,rsyslogd: error forwarding via tcp, suspending...
linux,2005-10-21,11:36:25,2005-10-21,11:36:25,5,3,rsyslogd: db error (2006): MySQL server has gone away

linux,2005-10-21,11:36:25,2005-10-21,11:36:25,5,3,rsyslogd: db error (2006): MySQL server has gone away

why?

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

mysql> show databases;
+----------+
| Database |
+----------+
| Syslog |
| mysql |
| test |
+----------+
3 rows in set (0.00 sec)

mysql> show tables;
ERROR 1046 (3D000): No database selected
mysql> use Syslog
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> show tables;
+------------------------+
| Tables_in_Syslog |
+------------------------+
| SystemEvents |
| SystemEventsProperties |
+------------------------+
2 rows in set (0.00 sec)

mysql>

looks like we are getting somewhere OK, let's see after the error. Somethng seems to have happend between the messages, because it first could not connect to MySQL and later it did (but MySQL crashed). From what I've found on the web, the initial error mgiht be due to an invalid port setting in MySQL. Anyhow, I suggest that you check the MySQL logs if there is any error report. I guess there is something...

oh, one thing. I remeber strange errors when the mysql client library used during make rsyslog was to old. Check that your mysql-dev (or similar name) is a recent one. If not, update and in rsyslog run

make clean
make
make install

root@linux:/var/log# mysqladmin -p**** version
mysqladmin Ver 8.41 Distrib 4.1.14, for slackware-linux-gnu on i486
Copyright (C) 2000 MySQL AB & MySQL Finland AB & TCX DataKonsult AB
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL license

Server version 4.1.14
Protocol version 10
Connection Localhost via UNIX socket
UNIX socket /var/run/mysql/mysql.sock
Uptime: 18 hours 52 min 55 sec

Threads: 2 Questions: 39 Slow queries: 0 Opens: 15 Flush tables: 1 Open tables: 2 Queries per second avg: 0.001
root@linux:/var/log#

root@linux:/var/log# cd /etc/
root@linux:/etc# pico rsyslog.conf

# And this finally is a database action
# The semicolon at the end is theoreticaly not necessary,
# but the current rsyslogd has a bug that makes it abort if
# it is missing. As Dennis Olvany pointed out, it would e
# extremely nice to have this semicolon in the sample conf
*.* >127.0.0.1,Syslog,root,****;
# It uses the default schema (MonitorWare format). The parameters
# should be self-explanatory.
# And this one uses the template defined above:
*.* >127.0.0.1,Syslog,root,***;dbFormat