Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a pair of sonicwall devices pointed at an rsyslog (v4.6.2) instance that are apparently formatting their messages unagreeably for the mysql plugin.

The rsyslog instance logs other devices without issue (linux servers and some switches) but the message portion for the sonicwall devices comes back as

$msg*INVALID PROPERTY NAME*

The rest of the message is logged correctly (time, source, facility etc)

Looking at the rsyslog debug log, I see this on reciept of the message

timestamp: Called action, logging to ommysql.so

timestamp: invalid property id: '0'

If I also log to the recommended "debug" template (file based), the result is similar to the following:

FROMHOST: 'X.X.X.X', HOSTNAME: 'Real Hostname', PRI: 129, syslogtag 'id=firewall', programname: 'id=firewall', APP-NAME: 'id=firewall', PROCID: '-', MSGID: '-',

TIMESTAMP: 'Jan 31 14:10:12', STRUCTURED-DATA: '-',

msg: ' sn=0017C5272ED0 time="2012-01-31 14:10:13" fw=X.X.X.X pri=1 c=32 m=608 msg="IPS

Detection Alert: INFO SNMP Access (UDP)" sid=748 ipscat=INFO ipspri=3 n=0 src=X.X.X.X:LAN:DNS_NAME dst=X.X.X.X:161:PRINTERS:'

rawmsg: '<129>id=firewall sn=0017C5272ED0 time="2012-01-31 14:10:13" fw=X.X.X.X pri=1 c=32 m=608 msg="IPS Detection Alert: INFO SNMP (UDP)" sid=748 ipscat=INFO ipspri=3 n=0 src=X.X.X.X:1052:LAN:DNS_NAME dst=X.X.X.X:161:PRINTERS:'

rsyslog is now up to version 6.3.3, but I can't find any confirmation my issue is corrected in a later version.

I'd like to stick with the official rpms from centos if possible, however the "debug template" looking ok leads me to believe it's an issue with the mysql plugin and upgrading may be my only option.

Before I go that route, any idea if this is something I can correct by altering the template I'm using or some other setting I missed ?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

There is a typo in the sql template, $msg% instead of %msg%; which rsyslog tried to tell me, and I even quoted in my original question.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.