MonitorWare Knowledge Base

Hiya.

Installed the 0.9.5 version of rsyslog with support for MySQL.
Works like a dandy, and data keeps coming into my db.

Then i installed 0.9.6, and it all went downhill from here..

What i did was edit the Makefile for 0.9.6 to enable mysql, and corrected the path to the mysqlclient. It all compiled ok, and make install worked ok.

But when i fire it up it doesen't insert anything into the database.
From what i can see with debug mode it says:
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FILE: /var/log/winsyslog-like.log
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FILE: /var/log/traditionalfile.log
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FILE: /var/log/anothertraditionalfile.log
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF USERS: >my.hostname.no, syslog, syslogge-user,password,


in the startup-phase. Ive "masked" hostname, user and pwd..
but the "," at the end is correct..

While the 0.9.5 says MYSQL: instead of USERS..

Any idea?

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

I guess you found the pitfall with the new build system. See

http://www.rsyslog.com/Article25.phtml

You need to enable MySQL in the Makefile in the distro-specific directory. Please have a look at the new install doc, especially step 2:

http://www.rsyslog.com/Documentation-/i ... html.phtml

Please let me know if that fixes the issue.

Rainer

Oh, one more side note: I think I should make rsyslgod to spit out a good error message if you have a MySQL selector line but MySQL is disabled. That would eventually help

Just for the records: I just changed this in the upcoming 0.9.7 version. It's already in the CVS

The Makefile was updated to contain FEATURE_DB=1 before i did the make;make install bit.
So the MySQL but should be enabled.
In the 0.9.5 version the debug-info said that the connection to the database was ok, but there is no such line in the 0.9.6 version, so it looks like it is not even trying to connect to the database..

Has there been any changes to the config-file from 0.9.5 to 0.9.6 ? I'm tryin' to run the newest version with the same config-file as the old?

Oops... that sounds like the change did not apply. What you see actually means that the version is compiled WITHOUT MySQL support (else you would see different messages). The config file syntax is the same, so this is not the cause. I would appreciate if you let me know in which subdirectory you were when building and I would also appreciate if you could send me the messages that appeared during make and make install. I would be very interested to nail this down as soon as possible.

BTW: if you register at the forum, you can opt in to receive a notification whenever someone answers to the thread. That saves you from polling it...

Rainer

The system is running a Fedora Core 3.

What i had to do to get it to work was changing the directory for the mysql-client libraries from /usr/local/lib/mysql to /usr/lib/mysql.
Here is the info from the compiling and installing:

[root@scrooge linux]# pwd
/tmp/rsyslog-0.9.6/linux
[root@scrooge linux]# make
cc -O3 -DSYSV -fomit-frame-pointer -Wall -fno-strength-reduce -I/usr/local/include -DWITHDB -DSYSLOG_INET -DSYSLOG_UNIXAF -DFSSTND -DSYSLOGD_PIDNAME=\"rsyslogd.pid\" -c ../syslogd.c
cc -O3 -DSYSV -fomit-frame-pointer -Wall -fno-strength-reduce -I/usr/local/include -DWITHDB -c ../pidfile.c
cc -O3 -DSYSV -fomit-frame-pointer -Wall -fno-strength-reduce -I/usr/local/include -DWITHDB -c ../template.c
cc -O3 -DSYSV -fomit-frame-pointer -Wall -fno-strength-reduce -I/usr/local/include -DWITHDB -c ../stringbuf.c
cc -O3 -DSYSV -fomit-frame-pointer -Wall -fno-strength-reduce -I/usr/local/include -DWITHDB -c ../srUtils.c
cc -O3 -DSYSV -fomit-frame-pointer -Wall -fno-strength-reduce -I/usr/local/include -DWITHDB -c ../outchannel.c
cc -s -o syslogd syslogd.o pidfile.o template.o outchannel.o stringbuf.o srUtils.o -lmysqlclient -L/usr/lib/mysql
[root@scrooge linux]# make install
install ../rsyslogd.8 /usr/share/man/man8/rsyslogd.8
install ../rsyslog.conf.5 /usr/share/man/man5/rsyslog.conf.5
install -b -s syslogd /usr/sbin/rsyslogd
[root@scrooge linux]#


And This is the info from startup(ive anonymized the db-info):

[root@scrooge ~]# rsyslogd -r -m0 -d
Allocated parts table for 1024 file descriptors.
Starting.
Called init.
cfsysline --> template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n"
cfsysline --> template precise,"%syslogpriority%,%syslogfacility%,%timegenerated:::fulltime%,%HOSTNAME%,%syslogtag%,%msg%\n"
Invalid field option 'fulltime' specified - ignored.
cfsysline --> template RFC3164fmt,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%"
cfsysline --> template wallmsg,"\r\n\7Message from syslogd@%HOSTNAME% at %timegenerated% ...\r\n %syslogtag%%msg%\n\r"
cfsysline --> template WinSyslogFmt,"%HOSTNAME%,%timegenerated:1:10:date-rfc3339%,%timegenerated:12:19:date-rfc3339%,%timegenerated:1:10:date-rfc3339%,%timegenerated:12:19:date-rfc3339%,%syslogfacility%,%syslogpriority%,%syslogtag%%msg%\n"
cfsysline --> template dbFormat,"insert into SystemEvents (Message, Facility,FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%',%syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",sql
cfline(*.* /var/log/winsyslog-like.log;WinSyslogFmt)
symbolic name: * ==> 255
leading char in action: /
filename: '/var/log/winsyslog-like.log', template: 'WinSyslogFmt'
cfline(*.* /var/log/traditionalfile.log;TraditionalFormat)
symbolic name: * ==> 255
leading char in action: /
filename: '/var/log/traditionalfile.log', template: 'TraditionalFormat'
cfline(*.* /var/log/anothertraditionalfile.log)
symbolic name: * ==> 255
leading char in action: /
filename: '/var/log/anothertraditionalfile.log', template: ' TradFmt'
cfline(*.* >scrooge.allianse.no,syslog,syslogger,syslog)
symbolic name: * ==> 255
leading char in action: >
users: >scrooge.allianse.no,syslog,syslogger,syslog
Opened UNIX socket `/dev/log'.
Opened syslog UDP port.
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FILE: /var/log/winsyslog-like.log
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FILE: /var/log/traditionalfile.log
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FILE: /var/log/anothertraditionalfile.log
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF USERS: >hostname, dbname, username, passwd,
Template: Name=' TradFmt'
Entry(9dfe058): type 2, (FIELD), value: 'TIMESTAMP'
Entry(9dfe130): type 1, (CONSTANT), value: ' '
Entry(9dfe158): type 2, (FIELD), value: 'HOSTNAME'
Entry(9dfe230): type 1, (CONSTANT), value: ' '
Entry(9dfe258): type 2, (FIELD), value: 'syslogtag'
Entry(9dfe308): type 2, (FIELD), value: 'msg' [drop last LF in msg]
Entry(9dfe3e0): type 1, (CONSTANT), value: '
'
Template: Name=' WallFmt'
Entry(9dfe460): type 1, (CONSTANT), value: '
Message from syslogd@'
Entry(9dfe488): type 2, (FIELD), value: 'HOSTNAME'
Entry(9dfe560): type 1, (CONSTANT), value: ' at '
Entry(9dfe588): type 2, (FIELD), value: 'timegenerated'
Entry(9dfe660): type 1, (CONSTANT), value: ' ...
'
Entry(9dfe688): type 2, (FIELD), value: 'syslogtag'
Entry(9dfe738): type 2, (FIELD), value: 'msg'
Entry(9dfe810): type 1, (CONSTANT), value: '
'
Template: Name=' StdFwdFmt'
Entry(9dfe890): type 1, (CONSTANT), value: '<'
Entry(9dfe8b8): type 2, (FIELD), value: 'PRI'
Entry(9dfe990): type 1, (CONSTANT), value: '>'
Entry(9dfe9b8): type 2, (FIELD), value: 'TIMESTAMP'
Entry(9dfea90): type 1, (CONSTANT), value: ' '
Entry(9dfeab8): type 2, (FIELD), value: 'HOSTNAME'
Entry(9dfeb90): type 1, (CONSTANT), value: ' '
Entry(9dfebb8): type 2, (FIELD), value: 'syslogtag'
Entry(9dfec68): type 2, (FIELD), value: 'msg'
Template: Name=' StdUsrMsgFmt'
Entry(9dfed78): type 1, (CONSTANT), value: ' '
Entry(9dfeda0): type 2, (FIELD), value: 'syslogtag'
Entry(9dfee50): type 2, (FIELD), value: 'msg'
Entry(9dfef28): type 1, (CONSTANT), value: '
'
Template: Name=' StdDBFmt' [SQL-Format]
Entry(9dfef80): type 1, (CONSTANT), value: 'insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values (''
Entry(9dfeff0): type 2, (FIELD), value: 'msg'
Entry(9dff188): type 1, (CONSTANT), value: '', '
Entry(9dff1b0): type 2, (FIELD), value: 'syslogfacility'
Entry(9dff288): type 1, (CONSTANT), value: ', ''
Entry(9dff2b0): type 2, (FIELD), value: 'HOSTNAME'
Entry(9dff388): type 1, (CONSTANT), value: '', '
Entry(9dff3b0): type 2, (FIELD), value: 'syslogpriority'
Entry(9dff488): type 1, (CONSTANT), value: ', ''
Entry(9dff4b0): type 2, (FIELD), value: 'timereported' [Format as MySQL-Date]
Entry(9dff588): type 1, (CONSTANT), value: '', ''
Entry(9dff5b0): type 2, (FIELD), value: 'timegenerated' [Format as MySQL-Date]
Entry(9dff688): type 1, (CONSTANT), value: '', '
Entry(9dff6b0): type 2, (FIELD), value: 'iut'
Entry(9dff788): type 1, (CONSTANT), value: ', ''
Entry(9dff7b0): type 2, (FIELD), value: 'syslogtag'
Entry(9dff888): type 1, (CONSTANT), value: '')'
Template: Name='TraditionalFormat'
Entry(9e00e88): type 2, (FIELD), value: 'timegenerated'
Entry(9e017a0): type 1, (CONSTANT), value: ' '
Entry(9e017c8): type 2, (FIELD), value: 'HOSTNAME'
Entry(9e018a0): type 1, (CONSTANT), value: ' '
Entry(9e018c8): type 2, (FIELD), value: 'syslogtag'
Entry(9e01978): type 2, (FIELD), value: 'msg' [drop last LF in msg]
Entry(9e01a50): type 1, (CONSTANT), value: '
'
Template: Name='precise'
Entry(9e01a98): type 2, (FIELD), value: 'syslogpriority'
Entry(9e01b70): type 1, (CONSTANT), value: ','
Entry(9e01b98): type 2, (FIELD), value: 'syslogfacility'
Entry(9e01c70): type 1, (CONSTANT), value: ','
Entry(9e01c98): type 2, (FIELD), value: 'timegenerated'
Entry(9e01d70): type 1, (CONSTANT), value: ','
Entry(9e01d98): type 2, (FIELD), value: 'HOSTNAME'
Entry(9e01e70): type 1, (CONSTANT), value: ','
Entry(9e01e98): type 2, (FIELD), value: 'syslogtag'
Entry(9e01f70): type 1, (CONSTANT), value: ','
Entry(9e01f98): type 2, (FIELD), value: 'msg'
Entry(9e02070): type 1, (CONSTANT), value: '
'
Template: Name='RFC3164fmt'
Entry(9e020f0): type 1, (CONSTANT), value: '<'
Entry(9e02118): type 2, (FIELD), value: 'PRI'
Entry(9e021f0): type 1, (CONSTANT), value: '>'
Entry(9e02218): type 2, (FIELD), value: 'TIMESTAMP'
Entry(9e022f0): type 1, (CONSTANT), value: ' '
Entry(9e02318): type 2, (FIELD), value: 'HOSTNAME'
Entry(9e023f0): type 1, (CONSTANT), value: ' '
Entry(9e02418): type 2, (FIELD), value: 'syslogtag'
Entry(9e024c8): type 2, (FIELD), value: 'msg'
Template: Name='wallmsg'
Entry(9e025d0): type 1, (CONSTANT), value: '
Message from syslogd@'
Entry(9e025f8): type 2, (FIELD), value: 'HOSTNAME'
Entry(9e026d0): type 1, (CONSTANT), value: ' at '
Entry(9e026f8): type 2, (FIELD), value: 'timegenerated'
Entry(9e027d0): type 1, (CONSTANT), value: ' ...
'
Entry(9e027f8): type 2, (FIELD), value: 'syslogtag'
Entry(9e028a8): type 2, (FIELD), value: 'msg'
Entry(9e02980): type 1, (CONSTANT), value: '
'
Template: Name='WinSyslogFmt'
Entry(9e029e0): type 2, (FIELD), value: 'HOSTNAME'
Entry(9e02ab8): type 1, (CONSTANT), value: ','
Entry(9e02ae0): type 2, (FIELD), value: 'timegenerated' [Format as RFC3339-Date] [substring, from character 1 to 10]
Entry(9e02bb8): type 1, (CONSTANT), value: ','
Entry(9e02be0): type 2, (FIELD), value: 'timegenerated' [Format as RFC3339-Date] [substring, from character 12 to 19]
Entry(9e02cb8): type 1, (CONSTANT), value: ','
Entry(9e02ce0): type 2, (FIELD), value: 'timegenerated' [Format as RFC3339-Date] [substring, from character 1 to 10]
Entry(9e02db8): type 1, (CONSTANT), value: ','
Entry(9e02de0): type 2, (FIELD), value: 'timegenerated' [Format as RFC3339-Date] [substring, from character 12 to 19]
Entry(9e02eb8): type 1, (CONSTANT), value: ','
Entry(9e02ee0): type 2, (FIELD), value: 'syslogfacility'
Entry(9e02fb8): type 1, (CONSTANT), value: ','
Entry(9e02fe0): type 2, (FIELD), value: 'syslogpriority'
Entry(9e030b8): type 1, (CONSTANT), value: ','
Entry(9e030e0): type 2, (FIELD), value: 'syslogtag'
Entry(9e03190): type 2, (FIELD), value: 'msg'
Entry(9e03268): type 1, (CONSTANT), value: '
'
Template: Name='dbFormat' [SQL-Format]
Entry(9e032c0): type 1, (CONSTANT), value: 'insert into SystemEvents (Message, Facility,FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values (''
Entry(9e03330): type 2, (FIELD), value: 'msg'
Entry(9e034c8): type 1, (CONSTANT), value: '', '
Entry(9e034f0): type 2, (FIELD), value: 'syslogfacility'
Entry(9e035c8): type 1, (CONSTANT), value: ', ''
Entry(9e035f0): type 2, (FIELD), value: 'HOSTNAME'
Entry(9e036c8): type 1, (CONSTANT), value: '','
Entry(9e036f0): type 2, (FIELD), value: 'syslogpriority'
Entry(9e037c8): type 1, (CONSTANT), value: ', ''
Entry(9e037f0): type 2, (FIELD), value: 'timereported' [Format as MySQL-Date]
Entry(9e038c8): type 1, (CONSTANT), value: '', ''
Entry(9e038f0): type 2, (FIELD), value: 'timegenerated' [Format as MySQL-Date]
Entry(9e039c8): type 1, (CONSTANT), value: '', '
Entry(9e039f0): type 2, (FIELD), value: 'iut'
Entry(9e03ac8): type 1, (CONSTANT), value: ', ''
Entry(9e03af0): type 2, (FIELD), value: 'syslogtag'
Entry(9e03bc8): type 1, (CONSTANT), value: '')'
logmsg: syslog.info<46>, flags 4, from scrooge, msg rsyslogd: [origin software="rsyslogd" swVersion="0.9.6"] restart (remote reception).
Called fprintlog, logging to FILE
Called fprintlog, logging to FILE
Called fprintlog, logging to FILE
Called fprintlog, logging to USERS
rsyslogd: restarted.

Ah! It looks like there is a bug in the make file. I think the -DWITHDB is invalid. Please bear a little with me, I need to check it...

I don't know why it worked in my lab... maybe I fixed some things and didn't update the CVS

Actually, the Makefile in ./linux is buggy. On line 55 it has

WITHDB=-DWITHDB

which is wrong. Change it to:

WITHDB=-DWITH_DB

Note the underscore. I'll see that I update the build today to a bug fixing release. This is really bad... I'll also go through the code once again. But this most probably is the wohle issue. So I have not fully verified yet, because I thought a quick answer is helpful. I am 99.999% sure this is the only issue.

Please let me know your results.

Rainer

Works like a dandy

Thx

Thanks for the good news. I've also done some thourough testing and now released
rsyslog 0.9.7. I hope that will solve all issues now.

Rainer