Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Using FreeBSD 8.0 32 bit.

I have installed rsyslogd 5.5.5 with ommysql. (installed ports /usr/ports/sysutils/rsyslog55 and /usr/ports/sysutils/rsyslog55-mysql)

My rsyslog.conf file looks like:

$ModLoad imudp
$ModLoad imtcp
$ModLoad ommysql 
$ModLoad immark.so   
$ModLoad imuxsock.so 
$ModLoad imklog.so   
$OptimizeForUniprocessor on
$AllowedSender UDP, 10.0.0.0/8
$UDPServerAddress 0.0.0.0
$UDPServerRun 514
$UDPServerTimeRequery 2
#
+SG560
*.*     :ommysql:127.0.0.1,Syslog,sysloguser,mypassword

My command line flags for rsyslogd are: -c5 -4 Checking the code with -c5 -N1 returns no errors.

I have confirmed that rsyslogd is working by changing the last line to say:

*.*      /var/log/snapgear.log

which results in messages appearing in the snapgear.log file. So it is probably something to do with my MySQL setup

If I do:

mysql -u sysloguser -p Syslog
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 56
Server version: 5.0.86 FreeBSD port: mysql-server-5.0.86

mysql> select * from SystemEvents;
Empty set (0.00 sec)

mysql>

:-(

I have confirmed that sysloguser has full privileges for the Syslog database.

If I run rsyslogd on the console in debug mode:

/usr/local/sbin/rsyslogd -f /usr/local/etc/rsyslog.conf -c5 -n -d

I can see this sequence of events each time a message is received:

9244.376687256:28359280: main Q: entry added, size now log 1, phys 1 entries
9244.376705694:28359280: main Q: EnqueueMsg advised worker start
9244.376726647:28359280: Listening on UDP syslogd socket 4 (IPv4/port 514).
9244.376728602:28359280: --------imUDP calling select, active file descriptors (max 4): 4
9244.376890075:283593c0: wti 0x28306e80: worker awoke from idle processing
9244.376892031:283593c0: we deleted 0 objects and enqueued 0 objects
9244.376893986:283593c0: delete batch from store, new sizes: log 1, phys 1
9244.376895942:283593c0: msgConsumer processes msg 0/1
9244.376897898:283593c0: msg parser: flags 70, from '~NOTRESOLVED~', msg 'Jun 29 17:32:24 SG560 kernel: (20000629T1732244'
9244.376900132:283593c0: parse using parser list 0x283080e8 (the default list).
9244.376902088:283593c0: dropped LF at very end of message (DropTrailingLF is set)
9244.376904044:283593c0: Parser 'rsyslog.rfc5424' returned -2160
9244.376905999:283593c0: Message will now be parsed by the legacy syslog parser (one size fits all... ;)).
9244.376907955:283593c0: Parser 'rsyslog.rfc3164' returned 0
9244.376909910:283593c0: testing filter, f_pmask 255
9244.376911866:283593c0: Called action, logging to ommysql
9244.376918012:283593c0: actionTryResume: action state: susp, next retry (if applicable): 1277869250 [now 1277869244]
9244.376919967:283593c0: action call returned -2123
9244.376921923:283593c0: tryDoAction: unexpected error code -2123, finalizing
9244.376926113:283593c0: actionTryResume: action state: susp, next retry (if applicable): 1277869250 [now 1277869244]
9244.376928069:283593c0: ruleset: get iRet 0 from rule.ProcessMsg()
9244.376930024:283593c0: ruleset.ProcessMsg() returns 0
9244.376931980:283593c0: regular consumer finished, iret=0, szlog 0 sz phys 1
9244.376933936:283593c0: XXX: enqueueing data element 0 of 1
9244.376935891:283593c0: we deleted 1 objects and enqueued 0 objects
9244.376938126:283593c0: delete batch from store, new sizes: log 0, phys 0
9244.376940082:283593c0: regular consumer finished, iret=4, szlog 0 sz phys 0
9244.376942037:283593c0: main Q:Reg/w0: worker IDLE, waiting for work.

.... I can see the Action Call to ommysql returns unexpected error code -2123

Now I am stuck! Any ideas on what to look for next? Perhaps I there are extra ports I need to install? I will be very grateful for any assistance here!

share|improve this question

1 Answer 1

So I first thing , I take it you are using the default script for mysql.

If so all really looks fine the only thing i can recommend is to use a custom template so that you know the data you are sending will match the db format 100%.

If not you need to run the sql script that is provided with rsyslog to create the db and tables.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.