EventReporter/PhpLogCon issues

Support, Questions and Discussions on EventReporter

Moderator: alorbach

Google Ads


Re: EventReporter/PhpLogCon issues

Postby alorbach » Fri Aug 07, 2009 11:42 am

I just relized there are spaces between date and time at the beginning of the rsyslog template, I fixed that in my posts after a few minutes after I made it, I think you got the unfixed version, please try this template in rsyslog:

Code: Select all
$template WinSyslogFmt,"%timegenerated:1:10:date-rfc3339% %timegenerated:12:19:date-rfc3339%,%timegenerated:1:10:date-rfc3339% %timegenerated:12:19:date-rfc3339%,%HOSTNAME%,%syslogfacility%,%syslogpriority%,%syslogtag%%msg%\n"


best regards,
Andre Lorbach
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: EventReporter/PhpLogCon issues

Postby wendtmk » Fri Aug 07, 2009 11:56 am

Andre,

That's identical to the code I copied into the rsyslog.conf. I put it in anyway, restarted rsyslogd and there was no change.

Mark
wendtmk
Advanced
 
Posts: 26
Joined: Wed Aug 05, 2009 1:11 pm

Re: EventReporter/PhpLogCon issues

Postby alorbach » Fri Aug 07, 2009 12:26 pm

Indeed, my bad. But I see another error in the eventlog format which I didn't notice before.
Can you uncheck the Option "Add Sylog Source when forwarding" in the Forward Syslog Action in Eventreporter?

This breaks the format of the message itself.

best regards,
Andre Lorbach
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: EventReporter/PhpLogCon issues

Postby wendtmk » Fri Aug 07, 2009 12:38 pm

Andre,

Somewhat better, but the Date, Host, and Severity fields are now empty. Also emailed you the latest screen capture of the view.

Thanks,
Mark
wendtmk
Advanced
 
Posts: 26
Joined: Wed Aug 05, 2009 1:11 pm

Re: EventReporter/PhpLogCon issues

Postby alorbach » Fri Aug 07, 2009 12:40 pm

Can I see a few sample loglines now? Just to make sure the format is right now.
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: EventReporter/PhpLogCon issues

Postby wendtmk » Fri Aug 07, 2009 12:43 pm

You betcha. Here ya go:

2009-08-07T07:39:39-04:00 DCHOTEL1.spacenet.nrl.navy.mil EvntSLog: 7036,N\A,Service Control Manager,System,[INF],0,The Adiscon EvntSLog service entered the stopped state.
2009-08-07T07:39:39-04:00 DCHOTEL1.spacenet.nrl.navy.mil EvntSLog: 105,N\A,Adiscon EvntSLog,Application,[INF],0,The service was started.
2009-08-07T07:39:39-04:00 DCHOTEL1.spacenet.nrl.navy.mil EvntSLog: 7036,N\A,Service Control Manager,System,[INF],0,The Adiscon EvntSLog service entered the running state.

Mark
wendtmk
Advanced
 
Posts: 26
Joined: Wed Aug 05, 2009 1:11 pm

Re: EventReporter/PhpLogCon issues

Postby alorbach » Fri Aug 07, 2009 12:48 pm

Hrm it is the wrong (default) Syslog header in rsyslog again.
Your header looks like this now: "2009-08-07T07:39:39-04:00 DCHOTEL1.spacenet.nrl.navy.mil EvntSLog: " but is suppose to look like this: "2009-08-06 11:01:13,2009-08-06 11:01:13,DCHOTEL1.spacenet.nrl.navy.mil,22,6,EvntSLog: ".

You could change the LogLineType back to "syslog" now, but facility and priority would be missing.
Please check the template setting in rsyslog.conf again.

best regards,
Andre Lorbach
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: EventReporter/PhpLogCon issues

Postby wendtmk » Fri Aug 07, 2009 1:00 pm

Andre,

You're probably going to want to kick me for this... :mrgreen:

Somehow, during all this, the "WinSyslogFmt" template tag got dropped from the end of the rsyslog.conf line that tells rsyslogd where to drop the eventlogs. I replaced the tag, and now everything seems to be working perfectly!

Thank you very much for your help!

Mark
wendtmk
Advanced
 
Posts: 26
Joined: Wed Aug 05, 2009 1:11 pm

Re: EventReporter/PhpLogCon issues

Postby alorbach » Fri Aug 07, 2009 1:06 pm

lol :D you're welcome, I am glad it finally works ;)

best regards,
Andre Lorbach
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: EventReporter/PhpLogCon issues

Postby wendtmk » Fri Aug 07, 2009 1:30 pm

Yeah, me too! It was getting a little trying, not getting the results I thought I was going to get. Now that we got all the kinks worked out, we're going to be buying the EventReporter. We still have a few weeks left on the trial version, so I'm going to try and speed up the government behemoth to purchase the software. Thanks again!

Mark
wendtmk
Advanced
 
Posts: 26
Joined: Wed Aug 05, 2009 1:11 pm

Re: EventReporter/PhpLogCon issues

Postby alorbach » Thu Aug 13, 2009 2:25 pm

Hi,

for all other expiriencing problems getting EventReporter, RSyslog and phpLogCon working together, I have summed up all hints here:
http://wiki.rsyslog.com/index.php/PhpLo ... ntReporter

best regards,
Andre Lorbach
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: EventReporter/PhpLogCon issues

Postby hitjew » Mon Oct 31, 2011 10:19 am

Hello in here,
Could you help me with how to setup WinSyslog and phpLogCon using a MYSQL Database on Windows? I'd be grateful for any information.
hitjew
New
 
Posts: 2
Joined: Mon Oct 31, 2011 10:17 am

Re: EventReporter/PhpLogCon issues

Postby teifler » Mon Oct 31, 2011 1:15 pm

Hi,

Sorry but your question is a bit unclear to me. Which programs do you use for this? And what's your exact problem?

Do you know that phpLogCon renamed to Adiscon LogAnalyzer.

If you have not started yet, the easiest way to configurate the programs is to follow this Step-By-Step Guide:
http://loganalyzer.adiscon.com/articles ... r#more-144

This thread is pretty old please make a new thread.

Thanks.

best regards,
Tim Eifler
teifler
Frequent Poster
 
Posts: 56
Joined: Mon Sep 05, 2011 9:49 am

Google Ads


Previous

Return to EventReporter

Who is online

Users browsing this forum: No registered users and 1 guest

cron