Syslog monitor addon beta

[tgk]

I think I have a fix for the msg/message column.
In setup.php and functions.php, find the lines with:

[nahun]

[nahun]

After I edited the files to "msg" instead of "message" I got it to work almost perfectly. I had to edit the haloe_remove.php and haloe_alert.php too because I changed those mysql tables from "message" to "msg" too just to be consistent.

The only part that doesn't work yet are the alerts. The settings get saved, but no email. I'll work on it some more.

[mgb]

Alerts don't seem to be working for me either. Keep me posted.

[cigamit]

Wierd... I thought I was subscribed to this thread. Anyways, thanks for finding these bugs and I now have them fixed in my SVN copy. I will see about releasing a new version fairly soon.

Also, if you find anymore, if you could please issue them in my bug tracker
http://cactiusers.org/bugs/
as it will be easier for me to keep track of everything in there

[twelzy]

harlequin and cigamit,

(Just a sugestion...)

I think that is a little bit confusing identify each line/event when the syslog (haloe) plugin have several successive lines with the same priority!

Is there any possibility to put a line between each event?

See the images below:

Thanks in advance!
(...and sorry for my poor English!)

[nahun]

[twelzy]

nahun,

It works perfectly!
(I just changed the color of the lines from '000000' to '555555'...)

Thank you very much!
(...and sorry for my poor English!)

[nahun]

So alerts actually do work for me, but not if I set the alert rule to "hostname is" which is all I was trying until I saw part in the setup.php. In the haloe_poller_bottom function there is this part:

[nahun]

Ok I got everything to work now. Under:

[kingaru]

Soo.. if I'm correct the setup.php should select records for alarm which have "status=1" ... I just checked my database and all records in my syslog_incoming database have status=0 ... where and how this status is changing? Why it is always stays 0?

Thoughts?

Igor

[Amag]

Hey folks -

Great mod and great plugin architecture! I'm using Cigamit's version and it's working fine, but I have one problem/question:

My setup:

200+ devices logging to Kiwi Syslogger
Kiwi forwards to Cacti Syslogd

Cacti syslog seems to be behind by almost an hour! That is, I can cause a syslog event and it's immediately written to my Kiwi syslog, but it takes almost an hour for it to pop up in the Cacti syslog. I'm sure that Kiwi is forwarding immediately as I have it forwarding to another device and it receives it immediately.

The question:
1) Is Cacti only polling its syslogd to post to Cacti every x amount of minutes? If so, what is this timeframe and how do we change it?
2) If not, can someone give me any suggestions to troubleshoot?

Thanks as usual!
a.

[klr0514]

I have been working on this for a couple of days, but still not making much headway on this... Rather than beating my head on the wall a few more times, I was hoping someone may have some insight as to what is not working properly...

I am using Cacti 0.8.6h with the haloe plugin and the plugin architecture... I am getting the syslogs tab showing, and the tab seems to be working fine.... I have created tables and databases under MYSQL (5.0) and that seems to be okay. I have syslog-ng configure and that appears to be working. If I do a cat /tmp/mysql.pipe, I see the syslog alerts arriving:

INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '<ip_address of host>', 'local7', 'notice', 'notice','bd', '2006-04-04', '08:40:12', '316', '316: *Apr 4 12:26:14.226: %SYS-5-CONFIG_I: Configured from console by vty0' );

If I manually run MYSQL and run this command in the shell, this works fine. I still never see the output in my syslogs page... Here is the config.php:

$haloedb_type = "mysql";
$haloedb_default = "haloe";
$haloedb_hostname = "localhost";
$haloedb_username = "xxxxxx";
$haloedb_password = "xxxxxx";
/skip/
// Field Mappings, adjust to match the haloe table columns in use
$haloe_config["haloeTable"] = "syslog";
$haloe_config["incomingTable"] = "syslog_incoming";
$haloe_config["removeTable"] = "syslog_remove";
$haloe_config["alertTable"] = "syslog_alert";
$haloe_config["dateField"] = "date";
$haloe_config["timeField"] = "time";
$haloe_config["priorityField"] = "priority";
$haloe_config["facilityField"] = "facility";
$haloe_config["hostField"] = "host";
$haloe_config["textField"] = "message";
$haloe_config["id"] = "seq";


Any ideas??

[nahun]

[klr0514]

[root@dhcp-alpha-161-44-186-15 haloe]# /usr/local/mysql/bin/mysqlshow -u root --password=xxxx haloe
Database: haloe
+-----------------+
| Tables |
+-----------------+
| logs |
| syslog |
| syslog_alert |
| syslog_incoming |
| syslog_remove |
+-----------------+
[root@dhcp-alpha-161-44-186-15 haloe]# /usr/local/mysql/bin/mysqlshow -u root --password=xxxx haloe logs
Database: haloe Table: logs
+----------+------------------+-------------------+------+-----+---------+----------------+---------------------------------+---------+
| Field | Type | Collation | Null | Key | Default | Extra | Privileges | Comment |
+----------+------------------+-------------------+------+-----+---------+----------------+---------------------------------+---------+
| host | varchar(32) | latin1_swedish_ci | YES | MUL | | | select,insert,update,references | |
| facility | varchar(10) | latin1_swedish_ci | YES | MUL | | | select,insert,update,references | |
| priority | varchar(10) | latin1_swedish_ci | YES | MUL | | | select,insert,update,references | |
| level | varchar(10) | latin1_swedish_ci | YES | | | | select,insert,update,references | |
| tag | varchar(10) | latin1_swedish_ci | YES | | | | select,insert,update,references | |
| date | date | | YES | MUL | | | select,insert,update,references | |
| time | time | | YES | MUL | | | select,insert,update,references | |
| program | varchar(15) | latin1_swedish_ci | YES | MUL | | | select,insert,update,references | |
| msg | text | latin1_swedish_ci | YES | | | | select,insert,update,references | |
| seq | int(10) unsigned | | NO | PRI | | auto_increment | select,insert,update,references | |
+----------+------------------+-------------------+------+-----+---------+----------------+---------------------------------+---------+
[root@dhcp-alpha-161-44-186-15 haloe]#