MonitorWare Knowledge Base

I have installed LogAnalyzer but noticed it is (by my default) only reading the /var/log/messages file. I would like it to read the entire syslog message array (messages, maillog, secure, cron, spooler, boot.log, etc) is this possible, if so what do i need to do to set this up?

• Pulling out your Hair?
• Wasting Time and Money?
• Deadline Approaching?

Hi,

sure you can create as many logstream sources as you want.
If you have the UserDB System installed, you can add new logstream sources by using the Admin Center.

best regards,
Andre Lorbach

I don't believe i have the UserDB up. how would i configure that?

i have installed mysql + mysqk-server+ mysql-devel and started the service(chkconfig is on)
however when re-installing Log Analyzer, it appears to have an error with connecting to my new MySQL db. the error log shows up as:
[Wed Jul 07 16:06:21 2010] [error] [client 168.207.5.14] PHP Fatal error: Call to undefined function mysql_connect() in /var/www/html/loganalyzer/install.php on line 312, referer: http://172.29.xx.xx/loganalyzer/install.php?step=3

is there something else i need to have installed for this to work.

You can extend your current installation with the UserDB, see this article for more:
http://wiki.rsyslog.com/index.php/How_t ... llation%3F

However mysql extension for php does not seem to be installed on your server. Install php5-mysql package.

best regards,
Andre Lorbach

I have admin center up and running now, I get that you can add as many logstreams as wanted, but is there a way to get them all to show up in one search rather than having the users choose via a dropdown of the sources?

Anyone have any ideas for this. instead of multiple source files, I want 1 source file that will read ALL logs sent by Syslog. any idea how i can do this with my source reader configuration???

murphybr wrote:Anyone have any ideas for this. instead of multiple source files, I want 1 source file that will read ALL logs sent by Syslog. any idea how i can do this with my source reader configuration???

log everything into 1 file?

well say this is used for anywhere between 50-500 servers all the syslog files coming to the server housing this frontend application. those files are going to be large enough as it is... and since syslog encompasses /var/log/messages, /var/log/maillog, /dev/console, /var/log/secure, /var/log/cron, /var/log/spooler wouldnt it just be more feasible to have this read all at once rather than read a single file or take files that are already large enough as it will be and create a new file with all this info in it?

murphybr wrote:well say this is used for anywhere between 50-500 servers all the syslog files coming to the server housing this frontend application. those files are going to be large enough as it is... and since syslog encompasses /var/log/messages, /var/log/maillog, /dev/console, /var/log/secure, /var/log/cron, /var/log/spooler wouldnt it just be more feasible to have this read all at once rather than read a single file or take files that are already large enough as it will be and create a new file with all this info in it?

I don't understand what you want.

Hello guys,

Is there a way that Adiscon can read any log file? I do not mean the log files created by rsyslog. I mean any log file, for example, log files from PostgresQL.
Can anyone give me some advise?

Thank you