MonitorWare Knowledge Base

[fdacke]

Hi!

I have problems getting LogAnalyzer to read from the database. The backend is Ubuntu 10.04, running syslog-ng which sends the data to a MSSQL Database. For frontend I installed Loganalyzer on Ubuntu and have been trying to configure that to speak to the MSSQL Database.

First off I had to enable the database connection for LogAnalyzer. It complained about driver problems and I found that it was hardcoded with the standard Windows {SQL Server}-driver for ODBC. To get it working you had to "sudo apt-get install libdbd-freetdsphp5-sybase tdsodbc", create a /etc/odbcinst.ini with:

Code: Select all

[FreeTDS]
Description = FreeTDS Driver
Driver = /usr/lib/odbc/libtdsodbc.so
Setup = /usr/lib/odbc/libtdsS.so
FileUsage = 1
CPTimeout = 5
CPReuse = 5


And then you had to modify the file /var/www/loganalyzer/classes/logstreamconfigpdo.class.php on line ~100 changing {SQL Server} to FreeTDS.


That solved, I have created tables in my database according to the MonitorWare format at http://www.mwagent.com/step-by-step-gui ... formats-2/. When the table is empty, Loganalyzer reports "No syslog-logs found" correctly. When I populate the table, the index.php-page just goes blank. Nothing shows.

I tried creating another table with the "php-syslog-ng"-format. Same thing, it says "No syslog-logs found" and then goes blank when the table is populated.

I've used Wireshark to look at the packets going to the Databaseserver and the connection appears to be correct and the SELECT properly answered.

Why does the page go blank?
Where are the logs for LogAnalyzer?
What are the table definitions that LogAnalyzer are working with? The "php-syslog-ng"-format doesn't seem to be a standard...

Relevant config:

Code: Select all

$CFG['Sources']['Source1']['ID'] = 'Source1';
$CFG['Sources']['Source1']['Name'] = 'Database';
$CFG['Sources']['Source1']['ViewID'] = 'SYSLOG';
$CFG['Sources']['Source1']['SourceType'] = SOURCE_PDO;
$CFG['Sources']['Source1']['DBTableType'] = 'syslogng';
$CFG['Sources']['Source1']['DBType'] = DB_MSSQL;
$CFG['Sources']['Source1']['DBServer'] = '10.1.25.4';
$CFG['Sources']['Source1']['DBName'] = 'DBsyslogng';
$CFG['Sources']['Source1']['DBUser'] = 'LURWsyslogng';
$CFG['Sources']['Source1']['DBPassword'] = 'PASSWORD';
$CFG['Sources']['Source1']['DBTableName'] = 'logs';
$CFG['Sources']['Source1']['DBEnableRowCounting'] = false;


I've also tried setting up rsyslog but I can't get the database connection to work.

Thanks in advance!
Fredrik

[Burn]

I think you should check your webserver logs

[fdacke]

I found /var/log/apache2/error.log and /var/log/apache2/access.log. The relevant log-notices was when I connected to http://server-ip/loganalyzer/index.php and it showed the empty page described above.

The interesting part is defenetly the "Segmentation fault". Where can I get more information on that? Are there more log-files than these?

Code: Select all

[Mon Jul 19 09:05:46 2010] [error] [client 192.168.12.104] File does not exist: /var/www/favicon.ico
[Mon Jul 19 09:05:47 2010] [notice] child pid 30262 exit signal Segmentation fault (11)
[Mon Jul 19 09:05:49 2010] [error] [client 192.168.12.104] File does not exist: /var/www/favicon.ico

Code: Select all

192.168.12.104 - - [19/Jul/2010:09:05:46 +0200] "GET /favicon.ico HTTP/1.1" 404 502 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; sv-SE; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5"
192.168.12.104 - - [19/Jul/2010:09:05:49 +0200] "GET /favicon.ico HTTP/1.1" 404 501 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; sv-SE; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5"


Thanks for your help!

[alorbach]

The Apache-subprocess is failing. This is proberly a bug in the MSSQL Driver component you are using.
Not much we can do from loganalyzer point of view.

best regards,
Andre Lorbach