search

Cacti / plugin_syslog

Syslog Plugin for Cacti
GNU General Public License v2.0
21 stars 16 forks source link

syslog_incoming logtime I see 0000-00-00 00:00:00 #147

Closed itkroplis closed 3 years ago

itkroplis commented 3 years ago

Hi!

I was updated my cacti server: To Debian 10, apache2 latest, php7.3, syslog-ng 3 (3.19.1) , mysql Ver 15.1 Distrib 10.3.27-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2 I updated cacti to latest version. In cacti DB syslog_incoming logtime I see 0000-00-00 00:00:00 for any new row.

In WEBUI I see Unprocessed Messages info

How resolve it?

TheWitness commented 3 years ago

Double check your /etc/rsyslog.d/cacti.conf and ensure it's using the correct template. The syslog templates changed a while ago.

itkroplis commented 3 years ago

/etc/rsyslog.d/cacti.conf ?! But I use syslog-ng nano /etc/syslog-ng/syslog-ng.conf

destination d_mysql { sql(type(mysql) host("localhost") username("user") password("passwordi") database("syslog") table("syslog_incoming") columns("facility_id", "priority_id", "program", "date", "time", "host", "message") values("$FACILITY_NUM","$LEVEL_NUM","$PROGRAM","$YEAR-$MONTH-$DAY","$HOUR:$MIN:$SEC","$HOST","$MSGONLY")); };

log { source(s_all); destination(d_mysql); };

itkroplis commented 3 years ago

Ok I resolv it! I change In syslog_incoming Columns options to: date and time values. And changed columns sequences. image

TheWitness commented 3 years ago

Feel free to open a pull request on the README.md to update the instructions.

itkroplis commented 3 years ago

Ok, how is possible in syslog_incoming in "program" insert program name from rsyslog msg "commands.log Dec 25 19:14:13 gitlab username: root [10393]: ifconfig [0]"
I can't remember who handled it in the syslog-ng version. Currently I get all msg in "message" column. On host used this rsyslog conf

cd /etc/rsyslog.d/ cat > commands.log.conf

$ModLoad imfile #Load the imfile input module $InputFilePollInterval 10 $InputFileName /var/log/commands.log $InputFileTag commands.log $InputFileStateFile commands.log $InputFileSeverity Info $InputRunFileMonitor

$template commands_log, " commands.log %msg% "

if $programname == 'commands.log' then @10.10.10.251:514;commands_log if $programname == 'commands.log' then stop

itkroplis commented 3 years ago

I resolv it added in /etc/rsyslog.d/commands.log.conf %hostname%

$ModLoad imfile #Load the imfile input module $InputFilePollInterval 10 $InputFileName /var/log/commands.log $InputFileTag commands.log $InputFileStateFile commands.log $InputFileSeverity Info $InputFileFacility local7 $InputRunFileMonitor

$template commands, " %hostname% commandlog %msg% "

if $programname == 'commands.log' then @10.10.10.46:514;commands if $programname == 'commands.log' then stop