Information: Forum is in read-only mode
For details and other support options see https://www.adiscon.com/news/support-forum-set-to-read-only-mode/

First Beta of SyslogAppliance Available

Questions around SyslogAppliance, the virtual logging appliance.

Moderator: alorbach

Google Ads


0.0.4 feedback

Postby mlist » Thu Dec 18, 2008 5:31 pm

Hi rgerhards

I just tried version 0.0.4 but I see 2 strange things:

1) at startup the following error is diplayed (although the machine after seems to work correctly)
Error: Driver 'pcspkr' is already registered, aborting...

2) As previous version, when I login get the following warning:
--------warning-------
Logstream Warning
While reading the logstream, the php script timeout forced me to abort at this point.

If you want to avoid this, please increase the phpLogCon script timeout in your config.php. If the user system is installed, you can do that in Admin center.
------------------------

I already increased "Script Timeout" to 120 seconds but this warning is always displayed and it tooks me about 1 minute and 40 seconds before to display logs.
Virtual appliance is configured as shown:
1 cpu (I cannot add more cpu...)
2 GB of ram
Vmware server is running on very good server (hp blade system with fiber disk) and there is ONLY ONE appliance at the moment that is sending logs.
This is the same problem I had with previous version.I thought that this problem would have been solved in this release instead is still present. What do you think about it? What could cause this problem?
mlist
Advanced
 
Posts: 27
Joined: Thu Dec 18, 2008 12:15 pm

Re: First Beta of SyslogAppliance Available

Postby netgeek1 » Thu Dec 18, 2008 9:52 pm

First let me say this looks great!

Suggestion: Add full text searching. Filters work great if you know the IP, but if you only know the DNS name you can't filter by that and if you only know part of i you're SOL.

Also, I'm definitely not a MySQL person (or any database) so can you give me a quick tutorial on cleaning up the database. I accidentially turned on Information messages from my Cisco ASA and created about 30 pages in 10 seconds.

Thanks,
netgeek1
netgeek1
New
 
Posts: 1
Joined: Thu Dec 18, 2008 9:45 pm

Re: 0.0.4 feedback

Postby rgerhards » Fri Dec 19, 2008 11:36 am

mlist wrote:Hi rgerhards

I just tried version 0.0.4 but I see 2 strange things:

1) at startup the following error is diplayed (although the machine after seems to work correctly)
Error: Driver 'pcspkr' is already registered, aborting...

2) As previous version, when I login get the following warning:
--------warning-------
Logstream Warning
While reading the logstream, the php script timeout forced me to abort at this point.

If you want to avoid this, please increase the phpLogCon script timeout in your config.php. If the user system is installed, you can do that in Admin center.
------------------------

I already increased "Script Timeout" to 120 seconds but this warning is always displayed and it tooks me about 1 minute and 40 seconds before to display logs.
Virtual appliance is configured as shown:
1 cpu (I cannot add more cpu...)
2 GB of ram
Vmware server is running on very good server (hp blade system with fiber disk) and there is ONLY ONE appliance at the moment that is sending logs.
This is the same problem I had with previous version.I thought that this problem would have been solved in this release instead is still present. What do you think about it? What could cause this problem?


I have asked Andre, the main phpLogCon developer, about this. I agree that no such timeout should occur ;)
rgerhards
Site Admin
 
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

Postby mlist » Fri Dec 19, 2008 12:01 pm

ok thanks a lot rgerhards!
mlist
Advanced
 
Posts: 27
Joined: Thu Dec 18, 2008 12:15 pm

Re: First Beta of SyslogAppliance Available

Postby alorbach » Fri Dec 19, 2008 1:32 pm

netgeek1 wrote:Also, I'm definitely not a MySQL person (or any database) so can you give me a quick tutorial on cleaning up the database. I accidentially turned on Information messages from my Cisco ASA and created about 30 pages in 10 seconds.


You can use the maintenance functions in the source admin to cleanup the logstream source from all data. Just click the trashcan icon there.

best regards,
Andre Lorbcah
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: First Beta of SyslogAppliance Available

Postby rgerhards » Fri Dec 19, 2008 1:44 pm

netgeek1 wrote:Suggestion: Add full text searching. Filters work great if you know the IP, but if you only know the DNS name you can't filter by that and if you only know part of i you're SOL.


Full text searching actually is the default. It does a search inside the msg field. Is this what you meant?
rgerhards
Site Admin
 
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

Re: First Beta of SyslogAppliance Available

Postby mlist » Mon Jan 05, 2009 1:00 pm

Hi rgerhards

before all:
HAPPY NEW YEAR! :D

Do you have any news from Andre about timeout problem?
Moreover what do you think about my suggestions in post number 5?

Thanks again and good work.
mlist
Advanced
 
Posts: 27
Joined: Thu Dec 18, 2008 12:15 pm

Re: First Beta of SyslogAppliance Available

Postby alorbach » Mon Jan 05, 2009 1:33 pm

Hi,

you can manually update to phpLogCon 2.5.23 (beta), which was released 2 weeks ago. It contains some optimations which will make full text searching much faster:
phpLogCon 2.5.23 (beta)

best regards,
Andre Lorbach
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: First Beta of SyslogAppliance Available

Postby mlist » Mon Jan 05, 2009 4:45 pm

Hi Andre

before all thanks for your kind reply.
I'll try to update phplogcon during next days and I'll let you know.
just a question about upgrade procedure: I'm using rsyslog appliance version of 0.0.4. Is it enough to substitute existing phpLogCon files with those included in 2.5.23(beta)or must I modify something as suggested in the specific thread?
And what about timeout setting? Is 120 enough?

bye
Marco
Italy
mlist
Advanced
 
Posts: 27
Joined: Thu Dec 18, 2008 12:15 pm

Re: First Beta of SyslogAppliance Available

Postby alorbach » Wed Jan 07, 2009 11:19 am

Hi Marco,

you just need to copy the new phpLogCon files over the existing onces, if an database update is needed, you will be requested to do so when you access phplogCon over the webbrowser. Otherwise that's it ;)

best regards,
Andre Lorbach
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: First Beta of SyslogAppliance Available

Postby mlist » Thu Jan 08, 2009 3:28 pm

Hi Andre

I just updated to 2.5.23(beta) but still the same problem:

about 90 second to login and after I receive the following error:
----------
While reading the logstream, the php script timeout forced me to abort at this point.

If you want to avoid this, please increase the phpLogCon script timeout in your config.php. If the user system is installed, you can do that in Admin center.
---------

What do you think about it?
mlist
Advanced
 
Posts: 27
Joined: Thu Dec 18, 2008 12:15 pm

Re: First Beta of SyslogAppliance Available

Postby alorbach » Fri Jan 09, 2009 4:37 pm

But after the login, the load time returns to normal?
Or do you keep getting timeouts?

regards,
Andre
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: First Beta of SyslogAppliance Available

Postby reverend » Fri Jan 09, 2009 5:07 pm

alorbach wrote:
netgeek1 wrote:Also, I'm definitely not a MySQL person (or any database) so can you give me a quick tutorial on cleaning up the database. I accidentially turned on Information messages from my Cisco ASA and created about 30 pages in 10 seconds.


You can use the maintenance functions in the source admin to cleanup the logstream source from all data. Just click the trashcan icon there.

best regards,
Andre Lorbcah


I'm getting the error "Could not delete data in the '1' source" when trying to clean out the database using this maintenance function. Any idea?
reverend
New
 
Posts: 2
Joined: Fri Jan 09, 2009 5:00 pm

Re: First Beta of SyslogAppliance Available

Postby mlist » Fri Jan 09, 2009 5:12 pm

no. after login the reload is slow and always get timeout error.
Please not that I have just 1 device (a netscreen firewall) that is sending logs and the vmware machine (as already explained) is a very good server (with fiber disks) on which others virtual machines runs perfectly.
I just tried 3 times to reinstall everything but nothing is changed... :(
mlist
Advanced
 
Posts: 27
Joined: Thu Dec 18, 2008 12:15 pm

Re: First Beta of SyslogAppliance Available

Postby alorbach » Fri Jan 09, 2009 5:28 pm

When you are in the Sources Admin. can you click on the button to "Show Database stats" in the available actions?
I would need to see the rowcount and table filesize of the systemevents table.

And just to be on the safe side, can you check the version number which phpLogCon displays in the footer?

Another question, can you make sure that option "Enable Row Counting" is NOT enabled for your logsource? This option will have performance impact on any sql query against the systemevents table.
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Google Ads


PreviousNext

Return to SyslogAppliance

Who is online

Users browsing this forum: No registered users and 0 guests

cron