Mailing List Archive

Is rsyslog 1.17.5 RPM MySQL capable?
Hi,

I went here:

http://people.redhat.com/pvrabec/rpms/rsyslog/

and grabbed the rsyslog-1.17.5-1.src.rpm RPM, I then rebuilt it and installed
it onto an SL4.5 server (RHEL 4 U5).

I then setup a MySQL database, and setup the /etc/rsyslog.conf file to output
to that database based on the instructions here:

http://www.rsyslog.com/module-Static_Docs-view-f-rsyslog_mysql.html.phtml

After all that, I setup phpLogCon.

After all that, I see no entries getting logged into the MySQL database by
rsyslog. I've checked every step from the beginning and can only come to the
assumption that the rsyslog RPM above is not compiled with MySQL support??

Is this assumption valid and if so, why didn't the Red Hat person also make a
mysql one?

I'm guessing now I need to install from tarball? (I'd prefer RPM which is why
I started there first).

Any way I can see what the /sbin/rsyslog binary is compiled with?

Thanks.

Michael.
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
you can try to use ldd(1) to print the shared libraries which are used
by a specific executable.

e.g.
> ldd /usr/sbin/rsyslogd | grep mysql
> libmysqlclient.so.15 => /usr/lib/libmysqlclient.so.15
(0xb7d74000)

kind regards,
raoul bhatia

Michael Mansour wrote:
> Hi,
>
> I went here:
>
> http://people.redhat.com/pvrabec/rpms/rsyslog/
>
> and grabbed the rsyslog-1.17.5-1.src.rpm RPM, I then rebuilt it and installed
> it onto an SL4.5 server (RHEL 4 U5).
>
> I then setup a MySQL database, and setup the /etc/rsyslog.conf file to output
> to that database based on the instructions here:
>
> http://www.rsyslog.com/module-Static_Docs-view-f-rsyslog_mysql.html.phtml
>
> After all that, I setup phpLogCon.
>
> After all that, I see no entries getting logged into the MySQL database by
> rsyslog. I've checked every step from the beginning and can only come to the
> assumption that the rsyslog RPM above is not compiled with MySQL support??
>
> Is this assumption valid and if so, why didn't the Red Hat person also make a
> mysql one?
>
> I'm guessing now I need to install from tarball? (I'd prefer RPM which is why
> I started there first).
>
> Any way I can see what the /sbin/rsyslog binary is compiled with?
>
> Thanks.
>
> Michael.
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog


--
____________________________________________________________________
DI (FH) Raoul Bhatia M.Sc. E-Mail. r.bhatia at ipax.at
IPAX Web. http://www.ipax.at
Chief Technician, Support IRC. #ipax (quakenet)
____________________________________________________________________
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Michael Mansour
> Sent: Tuesday, August 07, 2007 3:32 PM
> To: rsyslog at lists.adiscon.com
> Subject: [rsyslog] Is rsyslog 1.17.5 RPM MySQL capable?
>
> Hi,
>
> I went here:
>
> http://people.redhat.com/pvrabec/rpms/rsyslog/
>
> and grabbed the rsyslog-1.17.5-1.src.rpm RPM, I then rebuilt it and
> installed
> it onto an SL4.5 server (RHEL 4 U5).
>
> I then setup a MySQL database, and setup the /etc/rsyslog.conf file to
> output
> to that database based on the instructions here:
>
> http://www.rsyslog.com/module-Static_Docs-view-f-
> rsyslog_mysql.html.phtml
>
> After all that, I setup phpLogCon.
>
> After all that, I see no entries getting logged into the MySQL
database
> by
> rsyslog. I've checked every step from the beginning and can only come
> to the
> assumption that the rsyslog RPM above is not compiled with MySQL
> support??
>
> Is this assumption valid and if so, why didn't the Red Hat person also
> make a
> mysql one?

Yes, I think so. I remember there was some discussion around this. I'll
try to find you the bugzilla ticket where this was discussed.
>
> I'm guessing now I need to install from tarball? (I'd prefer RPM which
> is why
> I started there first).

I am not much into the RPM thing ;) If you have the source available
inside the RPM try, you can eventually do a

./configure --enable-mysql

>
> Any way I can see what the /sbin/rsyslog binary is compiled with?

rsyslog -v

will show the compile-time settings.

This for now, will follow-up soon.
Rainer
>
> Thanks.
>
> Michael.
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
Rainer Gerhards wrote:
>> Any way I can see what the /sbin/rsyslog binary is compiled with?
>
> rsyslog -v

minor correction - adding a missing "d" ;)
> rsyslogd -v

kind regards,
raoul bhatia
--
____________________________________________________________________
DI (FH) Raoul Bhatia M.Sc. E-Mail. r.bhatia at ipax.at
IPAX Web. http://www.ipax.at
Chief Technician, Support IRC. #ipax (quakenet)
____________________________________________________________________
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
Hi Rainer,

Thanks for your quick response.

> > Hi,
> >
> > I went here:
> >
> > http://people.redhat.com/pvrabec/rpms/rsyslog/
> >
> > and grabbed the rsyslog-1.17.5-1.src.rpm RPM, I then rebuilt it and
> > installed
> > it onto an SL4.5 server (RHEL 4 U5).
> >
> > I then setup a MySQL database, and setup the /etc/rsyslog.conf file to
> > output
> > to that database based on the instructions here:
> >
> > http://www.rsyslog.com/module-Static_Docs-view-f-
> > rsyslog_mysql.html.phtml
> >
> > After all that, I setup phpLogCon.
> >
> > After all that, I see no entries getting logged into the MySQL
> database
> > by
> > rsyslog. I've checked every step from the beginning and can only come
> > to the
> > assumption that the rsyslog RPM above is not compiled with MySQL
> > support??
> >
> > Is this assumption valid and if so, why didn't the Red Hat person also
> > make a
> > mysql one?
>
> Yes, I think so. I remember there was some discussion around this. I'll
> try to find you the bugzilla ticket where this was discussed.

Ok.

> > I'm guessing now I need to install from tarball? (I'd prefer RPM which
> > is why
> > I started there first).
>
> I am not much into the RPM thing ;) If you have the source available
> inside the RPM try, you can eventually do a
>
> ./configure --enable-mysql

Hmmm.. I'll try this. But I have tried to compile from sources and keep
getting the error:

make: warning: Clock skew detected. Your build may be incomplete.
make: Warning: File `.deps/syslog.Po' has modification time 40 s in the future
make all-am
make[1]: Entering directory
`/mnt/software/elephant/Software/rsyslog/rsyslog-1.18.0'
make[1]: Warning: File `.deps/syslog.Po' has modification time 40 s in the future
make[1]: Nothing to be done for `all-am'.
make[1]: warning: Clock skew detected. Your build may be incomplete.
make[1]: Leaving directory
`/mnt/software/elephant/Software/rsyslog/rsyslog-1.18.0'
make: warning: Clock skew detected. Your build may be incomplete.

I've tried that with the 1.17.5 and 1.18.0 (as above) both give the same problem.

> > Any way I can see what the /sbin/rsyslog binary is compiled with?
>
> rsyslog -v
>
> will show the compile-time settings.

Ok, this is what I see:

# rsyslogd -v
rsyslogd 1.17.5, compiled with:
FEATURE_PTHREADS (dual-threading)
FEATURE_REGEXP
FEATURE_LARGEFILE
FEATURE_NETZIP (syslog message compression)
SYSLOG_INET (Internet/remote support)

See http://www.rsyslog.com for more information.

Hmm.. this doesn't seem to show MySQL??

The 1.18.0 binary I created above with the "skew problem" make shows:

# ./rsyslogd -v
rsyslogd 1.18.0, compiled with:
FEATURE_PTHREADS (dual-threading)
FEATURE_REGEXP
FEATURE_DB
FEATURE_LARGEFILE
FEATURE_NETZIP (syslog message compression)
SYSLOG_INET (Internet/remote support)

See http://www.rsyslog.com for more information.

Hmm.. both don't seem to mention MySQL and I know with 1.18.0 I used the
"./configure --enable-mysql" as it showed this after the configure:

****************************************************
rsyslog will be compiled with the followig settings:

Multithreading support enabled: yes
Klogd functionality enabled: yes
Regular expressions support enabled: yes
Zlib compression support enabled: yes
MySql support enabled: yes
Large file support enabled: yes
Networking support enabled: yes
Debug mode enabled: no


> This for now, will follow-up soon.

Thanks Rainer.

Michael.

> Rainer
> >
> > Thanks.
> >
> > Michael.
> >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
------- End of Original Message -------
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
Michael Mansour wrote:

noticed the "FEATURE_DB" entry?

> # rsyslogd -v
> rsyslogd 1.17.5, compiled with:
> FEATURE_PTHREADS (dual-threading)
> FEATURE_REGEXP
> FEATURE_LARGEFILE
> FEATURE_NETZIP (syslog message compression)
> SYSLOG_INET (Internet/remote support)
>
> See http://www.rsyslog.com for more information.
>
> Hmm.. this doesn't seem to show MySQL??
>
> The 1.18.0 binary I created above with the "skew problem" make shows:
>
> # ./rsyslogd -v
> rsyslogd 1.18.0, compiled with:
> FEATURE_PTHREADS (dual-threading)
> FEATURE_REGEXP
> FEATURE_DB
^^^^^^^^^^
> FEATURE_LARGEFILE
> FEATURE_NETZIP (syslog message compression)
> SYSLOG_INET (Internet/remote support)
>
> See http://www.rsyslog.com for more information.
>
> Hmm.. both don't seem to mention MySQL and I know with 1.18.0 I used the
> "./configure --enable-mysql" as it showed this after the configure:


moreover, ldd is the tool which tells you much more about a (dynamic
linked) binary then any "hardcoded" program information.

kind regards,
raoul bhatia
--
____________________________________________________________________
DI (FH) Raoul Bhatia M.Sc. E-Mail. r.bhatia at ipax.at
IPAX Web. http://www.ipax.at
Chief Technician, Support IRC. #ipax (quakenet)
____________________________________________________________________
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
Hi Raoul,

> you can try to use ldd(1) to print the shared libraries which are
> used by a specific executable.
>
> e.g.
> > ldd /usr/sbin/rsyslogd | grep mysql
> > libmysqlclient.so.15 => /usr/lib/libmysqlclient.so.15
> (0xb7d74000)

Yes, this is what slipped my mind and what I was trying to remember.

When I do this on the 1.17.5 (from the src.rpm):

# ldd /sbin/rsyslogd |grep mysql
#

and when I do it from the 1.18.0 I compiled (but which gives that skew error):

# ldd ./rsyslogd |grep mysql
libmysqlclient.so.14 => /usr/lib/mysql/libmysqlclient.so.14 (0x004fb000)

So basically, the http://people.redhat.com/pvrabec/rpms/rsyslog/ site for this
is not mysql enabled.

That's somewhat frustrating because I'm not sure now I can successfully
compile rsyslog with this skew error.

Michael.

> kind regards,
> raoul bhatia
>
> Michael Mansour wrote:
> > Hi,
> >
> > I went here:
> >
> > http://people.redhat.com/pvrabec/rpms/rsyslog/
> >
> > and grabbed the rsyslog-1.17.5-1.src.rpm RPM, I then rebuilt it and installed
> > it onto an SL4.5 server (RHEL 4 U5).
> >
> > I then setup a MySQL database, and setup the /etc/rsyslog.conf file to output
> > to that database based on the instructions here:
> >
> > http://www.rsyslog.com/module-Static_Docs-view-f-rsyslog_mysql.html.phtml
> >
> > After all that, I setup phpLogCon.
> >
> > After all that, I see no entries getting logged into the MySQL database by
> > rsyslog. I've checked every step from the beginning and can only come to the
> > assumption that the rsyslog RPM above is not compiled with MySQL support??
> >
> > Is this assumption valid and if so, why didn't the Red Hat person also make a
> > mysql one?
> >
> > I'm guessing now I need to install from tarball? (I'd prefer RPM which is why
> > I started there first).
> >
> > Any way I can see what the /sbin/rsyslog binary is compiled with?
> >
> > Thanks.
> >
> > Michael.
> >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>
> --
> ____________________________________________________________________
> DI (FH) Raoul Bhatia M.Sc. E-Mail. r.bhatia at ipax.at
> IPAX Web. http://www.ipax.at
> Chief Technician, Support IRC. #ipax (quakenet)
> ____________________________________________________________________
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
------- End of Original Message -------
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
Hi,

> > Hi,
> >
> > I went here:
> >
> > http://people.redhat.com/pvrabec/rpms/rsyslog/
> >
> > and grabbed the rsyslog-1.17.5-1.src.rpm RPM, I then rebuilt it and
> > installed
> > it onto an SL4.5 server (RHEL 4 U5).
> >
> > I then setup a MySQL database, and setup the /etc/rsyslog.conf file to
> > output
> > to that database based on the instructions here:
> >
> > http://www.rsyslog.com/module-Static_Docs-view-f-
> > rsyslog_mysql.html.phtml
> >
> > After all that, I setup phpLogCon.
> >
> > After all that, I see no entries getting logged into the MySQL
> database
> > by
> > rsyslog. I've checked every step from the beginning and can only come
> > to the
> > assumption that the rsyslog RPM above is not compiled with MySQL
> > support??
> >
> > Is this assumption valid and if so, why didn't the Red Hat person also
> > make a
> > mysql one?
>
> Yes, I think so. I remember there was some discussion around this. I'll
> try to find you the bugzilla ticket where this was discussed.
> >
> > I'm guessing now I need to install from tarball? (I'd prefer RPM which
> > is why
> > I started there first).
>
> I am not much into the RPM thing ;) If you have the source available
> inside the RPM try, you can eventually do a
>
> ./configure --enable-mysql
>
> >
> > Any way I can see what the /sbin/rsyslog binary is compiled with?
>
> rsyslog -v
>
> will show the compile-time settings.
>
> This for now, will follow-up soon.
> Rainer

I've made progress but unfortunately rsyslogd ends up segfaulting when trying
to run in mysql mode.

I took the rsyslog-1.17.5-1.src.rpm file and installed it, modified the
/usr/src/redhat/SPECS/rsyslog.spec file to add:

%configure --sbindir=%{sbindir} --enable-mysql

to the configure line, this then compiled a mysql enabled version (checked
with ldd).

However, when try to start rsyslogd with the

*.* >database-server,database-name,database-userid,database-password

entry (filled out to my details) as the last line in /etc/rsyslog.conf, the
start up hangs. When I comment out the line above, the startup succeeds.

When I run this in debug to see what's going on, pages of stuff ending with:

Messages with malicious PTR DNS Records are not dropped.
Control characters are replaced upon reception.
Control character escape sequence prefix is '#'.
-1208325536: logmsg: syslog.info<46>, flags 5, from '', msg [origin
software="rsyslogd" swVersion="1.17.5" x-pid="11790"][x-configInfo
udpReception="No" udpPort="514" tcpReception="No" tcpPort="0"] restart
-1208325536: Message has legacy syslog format.
-1208325536: enqueueMsg: not yet running on multiple threads
-1208325536: Called fprintlog, logging to builtin-file (/var/log/messages)
-1208325536: Called fprintlog, logging to builtin-mysqlSegmentation fault

a segmentation fault.

When I try the same thing with the rsyslog-1.18.0 I compiled earlier:

[root at server rsyslog-1.18.0]# ./rsyslogd -m 0 -x -d

I get this logged into the messages file:

Aug 8 00:48:41 server rsyslogd: [origin software="rsyslogd"
swVersion="1.18.0" x-pid="12621"][x-configInfo udpReception="No" udpPort="514"
tcpReception="No" tcpPort="0"] restart
Aug 8 00:48:41 server rsyslogd:To enable MySQL logging, a "$ModLoad MySQL"
must be done - accepted for the time being, but will fail in future releases.
Aug 8 00:48:41 server rsyslogd:invalid character in selector line -
';template' expected
Aug 8 00:48:41 server rsyslogd:the last error occured in /etc/rsyslog.conf,
line 31
Aug 8 00:48:41 server rsyslogd:warning: selector line without actions will be
discarded

but that may be due to not actually doing a "make install" of 1.18.0 where the
klogd and rfc3195d files installed in the OS are for 1.17.5.

If they're not, does it give us a clue to the problem?

Thanks,

Michael.
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
Michael,

glad you got that far. I think output modularization brought up an old
issue again: Add a semicolon to the end of the db action line. The MySQL
command line parser is pretty old and could need an upgrade. I've stayed
away from that, because it will be replaced when we do a new config file
format. I'd appreciate if you could try. I'll also try to repro your
bug, but I need to finish something else first.

So the line should be like

*.*
>database-server,database-name,database-userid,database-password;

NOTE THE END OF THE LINE!

Please let me know the outcome.

Rainer
> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Michael Mansour
> Sent: Tuesday, August 07, 2007 4:54 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] Is rsyslog 1.17.5 RPM MySQL capable?
>
> Hi,
>
> > > Hi,
> > >
> > > I went here:
> > >
> > > http://people.redhat.com/pvrabec/rpms/rsyslog/
> > >
> > > and grabbed the rsyslog-1.17.5-1.src.rpm RPM, I then rebuilt it
and
> > > installed
> > > it onto an SL4.5 server (RHEL 4 U5).
> > >
> > > I then setup a MySQL database, and setup the /etc/rsyslog.conf
file
> to
> > > output
> > > to that database based on the instructions here:
> > >
> > > http://www.rsyslog.com/module-Static_Docs-view-f-
> > > rsyslog_mysql.html.phtml
> > >
> > > After all that, I setup phpLogCon.
> > >
> > > After all that, I see no entries getting logged into the MySQL
> > database
> > > by
> > > rsyslog. I've checked every step from the beginning and can only
> come
> > > to the
> > > assumption that the rsyslog RPM above is not compiled with MySQL
> > > support??
> > >
> > > Is this assumption valid and if so, why didn't the Red Hat person
> also
> > > make a
> > > mysql one?
> >
> > Yes, I think so. I remember there was some discussion around this.
> I'll
> > try to find you the bugzilla ticket where this was discussed.
> > >
> > > I'm guessing now I need to install from tarball? (I'd prefer RPM
> which
> > > is why
> > > I started there first).
> >
> > I am not much into the RPM thing ;) If you have the source available
> > inside the RPM try, you can eventually do a
> >
> > ./configure --enable-mysql
> >
> > >
> > > Any way I can see what the /sbin/rsyslog binary is compiled with?
> >
> > rsyslog -v
> >
> > will show the compile-time settings.
> >
> > This for now, will follow-up soon.
> > Rainer
>
> I've made progress but unfortunately rsyslogd ends up segfaulting when
> trying
> to run in mysql mode.
>
> I took the rsyslog-1.17.5-1.src.rpm file and installed it, modified
the
> /usr/src/redhat/SPECS/rsyslog.spec file to add:
>
> %configure --sbindir=%{sbindir} --enable-mysql
>
> to the configure line, this then compiled a mysql enabled version
> (checked
> with ldd).
>
> However, when try to start rsyslogd with the
>
> *.* >database-server,database-name,database-userid,database-
> password
>
> entry (filled out to my details) as the last line in
/etc/rsyslog.conf,
> the
> start up hangs. When I comment out the line above, the startup
> succeeds.
>
> When I run this in debug to see what's going on, pages of stuff ending
> with:
>
> Messages with malicious PTR DNS Records are not dropped.
> Control characters are replaced upon reception.
> Control character escape sequence prefix is '#'.
> -1208325536: logmsg: syslog.info<46>, flags 5, from '', msg [origin
> software="rsyslogd" swVersion="1.17.5" x-pid="11790"][x-configInfo
> udpReception="No" udpPort="514" tcpReception="No" tcpPort="0"] restart
> -1208325536: Message has legacy syslog format.
> -1208325536: enqueueMsg: not yet running on multiple threads
> -1208325536: Called fprintlog, logging to builtin-file
> (/var/log/messages)
> -1208325536: Called fprintlog, logging to builtin-mysqlSegmentation
> fault
>
> a segmentation fault.
>
> When I try the same thing with the rsyslog-1.18.0 I compiled earlier:
>
> [root at server rsyslog-1.18.0]# ./rsyslogd -m 0 -x -d
>
> I get this logged into the messages file:
>
> Aug 8 00:48:41 server rsyslogd: [origin software="rsyslogd"
> swVersion="1.18.0" x-pid="12621"][x-configInfo udpReception="No"
> udpPort="514"
> tcpReception="No" tcpPort="0"] restart
> Aug 8 00:48:41 server rsyslogd:To enable MySQL logging, a "$ModLoad
> MySQL"
> must be done - accepted for the time being, but will fail in future
> releases.
> Aug 8 00:48:41 server rsyslogd:invalid character in selector line -
> ';template' expected
> Aug 8 00:48:41 server rsyslogd:the last error occured in
> /etc/rsyslog.conf,
> line 31
> Aug 8 00:48:41 server rsyslogd:warning: selector line without actions
> will be
> discarded
>
> but that may be due to not actually doing a "make install" of 1.18.0
> where the
> klogd and rfc3195d files installed in the OS are for 1.17.5.
>
> If they're not, does it give us a clue to the problem?
>
> Thanks,
>
> Michael.
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
Hi Rainer,

> Michael,
>
> glad you got that far. I think output modularization brought up an
> old issue again: Add a semicolon to the end of the db action line.
> The MySQL command line parser is pretty old and could need an
> upgrade. I've stayed away from that, because it will be replaced
> when we do a new config file format. I'd appreciate if you could
> try. I'll also try to repro your bug, but I need to finish something
> else first.
>
> So the line should be like
>
> *.*
> >database-server,database-name,database-userid,database-password;
>
> NOTE THE END OF THE LINE!

Yes that was spot on. I added the semicolon for 1.18.0, ran the debug and it
went through and (finally) logged entries into the database (1.17.5 would
still segfault).

I then just moved those three binaries in /sbin to .orig and copied across the
ones for 1.18.0 into /sbin, then did the "service rsyslog start" and all worked:

Aug 8 01:11:37 server rsyslogd: [origin software="rsyslogd"
swVersion="1.18.0" x-pid="15789"][x-configInfo udpReception="No" udpPort="514"
tcpReception="No" tcpPort="0"] restart
Aug 8 01:11:37 server rsyslogd:To enable MySQL logging, a "$ModLoad MySQL"
must be done - accepted for the time being, but will fail in future releases.
Aug 8 01:11:37 server rsyslog: rsyslogd startup succeeded
Aug 8 01:11:37 server rsyslog: rklogd startup succeeded
Aug 8 01:11:37 server kernel: rklogd 1.18.0, log source = /proc/kmsg started.

where:

# rsyslogd -v
rsyslogd 1.18.0, compiled with:
FEATURE_PTHREADS (dual-threading)
FEATURE_REGEXP
FEATURE_DB
FEATURE_LARGEFILE
FEATURE_NETZIP (syslog message compression)
SYSLOG_INET (Internet/remote support)

See http://www.rsyslog.com for more information.

and:

# ldd rsyslogd |grep mysql
libmysqlclient.so.14 => /usr/lib/mysql/libmysqlclient.so.14 (0x004fb000)

and I see the entries getting logged into the SystemEvents table.

From here phpLogCon shows:

5 most recent logs (filter settings apply):

No data found!

Note: There are 23 events in the database, which are in the future!

ie. there are events in the database which I can't view, but now this may be
due to a database change between 1.17.5 and 1.18.0 ??

It's too late in the morning now so I'll carry on with this tomorrow sometime.
But if you have suggestions on what could be wrong with phpLogCon (ie. why I'm
not actually viewing the entries even though events do exist) please let me know.

Thanks again.

Michael.

> Please let me know the outcome.
>
> Rainer
> > -----Original Message-----
> > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> > bounces at lists.adiscon.com] On Behalf Of Michael Mansour
> > Sent: Tuesday, August 07, 2007 4:54 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] Is rsyslog 1.17.5 RPM MySQL capable?
> >
> > Hi,
> >
> > > > Hi,
> > > >
> > > > I went here:
> > > >
> > > > http://people.redhat.com/pvrabec/rpms/rsyslog/
> > > >
> > > > and grabbed the rsyslog-1.17.5-1.src.rpm RPM, I then rebuilt it
> and
> > > > installed
> > > > it onto an SL4.5 server (RHEL 4 U5).
> > > >
> > > > I then setup a MySQL database, and setup the /etc/rsyslog.conf
> file
> > to
> > > > output
> > > > to that database based on the instructions here:
> > > >
> > > > http://www.rsyslog.com/module-Static_Docs-view-f-
> > > > rsyslog_mysql.html.phtml
> > > >
> > > > After all that, I setup phpLogCon.
> > > >
> > > > After all that, I see no entries getting logged into the MySQL
> > > database
> > > > by
> > > > rsyslog. I've checked every step from the beginning and can only
> > come
> > > > to the
> > > > assumption that the rsyslog RPM above is not compiled with MySQL
> > > > support??
> > > >
> > > > Is this assumption valid and if so, why didn't the Red Hat person
> > also
> > > > make a
> > > > mysql one?
> > >
> > > Yes, I think so. I remember there was some discussion around this.
> > I'll
> > > try to find you the bugzilla ticket where this was discussed.
> > > >
> > > > I'm guessing now I need to install from tarball? (I'd prefer RPM
> > which
> > > > is why
> > > > I started there first).
> > >
> > > I am not much into the RPM thing ;) If you have the source available
> > > inside the RPM try, you can eventually do a
> > >
> > > ./configure --enable-mysql
> > >
> > > >
> > > > Any way I can see what the /sbin/rsyslog binary is compiled with?
> > >
> > > rsyslog -v
> > >
> > > will show the compile-time settings.
> > >
> > > This for now, will follow-up soon.
> > > Rainer
> >
> > I've made progress but unfortunately rsyslogd ends up segfaulting when
> > trying
> > to run in mysql mode.
> >
> > I took the rsyslog-1.17.5-1.src.rpm file and installed it, modified
> the
> > /usr/src/redhat/SPECS/rsyslog.spec file to add:
> >
> > %configure --sbindir=%{sbindir} --enable-mysql
> >
> > to the configure line, this then compiled a mysql enabled version
> > (checked
> > with ldd).
> >
> > However, when try to start rsyslogd with the
> >
> > *.* >database-server,database-name,database-userid,database-
> > password
> >
> > entry (filled out to my details) as the last line in
> /etc/rsyslog.conf,
> > the
> > start up hangs. When I comment out the line above, the startup
> > succeeds.
> >
> > When I run this in debug to see what's going on, pages of stuff ending
> > with:
> >
> > Messages with malicious PTR DNS Records are not dropped.
> > Control characters are replaced upon reception.
> > Control character escape sequence prefix is '#'.
> > -1208325536: logmsg: syslog.info<46>, flags 5, from '', msg [origin
> > software="rsyslogd" swVersion="1.17.5" x-pid="11790"][x-configInfo
> > udpReception="No" udpPort="514" tcpReception="No" tcpPort="0"] restart
> > -1208325536: Message has legacy syslog format.
> > -1208325536: enqueueMsg: not yet running on multiple threads
> > -1208325536: Called fprintlog, logging to builtin-file
> > (/var/log/messages)
> > -1208325536: Called fprintlog, logging to builtin-mysqlSegmentation
> > fault
> >
> > a segmentation fault.
> >
> > When I try the same thing with the rsyslog-1.18.0 I compiled earlier:
> >
> > [root at server rsyslog-1.18.0]# ./rsyslogd -m 0 -x -d
> >
> > I get this logged into the messages file:
> >
> > Aug 8 00:48:41 server rsyslogd: [origin software="rsyslogd"
> > swVersion="1.18.0" x-pid="12621"][x-configInfo udpReception="No"
> > udpPort="514"
> > tcpReception="No" tcpPort="0"] restart
> > Aug 8 00:48:41 server rsyslogd:To enable MySQL logging, a "$ModLoad
> > MySQL"
> > must be done - accepted for the time being, but will fail in future
> > releases.
> > Aug 8 00:48:41 server rsyslogd:invalid character in selector line -
> > ';template' expected
> > Aug 8 00:48:41 server rsyslogd:the last error occured in
> > /etc/rsyslog.conf,
> > line 31
> > Aug 8 00:48:41 server rsyslogd:warning: selector line without actions
> > will be
> > discarded
> >
> > but that may be due to not actually doing a "make install" of 1.18.0
> > where the
> > klogd and rfc3195d files installed in the OS are for 1.17.5.
> >
> > If they're not, does it give us a clue to the problem?
> >
> > Thanks,
> >
> > Michael.
> >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
------- End of Original Message -------
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
Hi Michael,

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Michael Mansour
> Sent: Tuesday, August 07, 2007 5:19 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] Is rsyslog 1.17.5 RPM MySQL capable?
>
> Hi Rainer,
>
> > Michael,
> >
> > glad you got that far. I think output modularization brought up an
> > old issue again: Add a semicolon to the end of the db action line.
> > The MySQL command line parser is pretty old and could need an
> > upgrade. I've stayed away from that, because it will be replaced
> > when we do a new config file format. I'd appreciate if you could
> > try. I'll also try to repro your bug, but I need to finish something
> > else first.
> >
> > So the line should be like
> >
> > *.*
> > >database-server,database-name,database-userid,database-password;
> >
> > NOTE THE END OF THE LINE!
>
> Yes that was spot on. I added the semicolon for 1.18.0, ran the debug
> and it
> went through and (finally) logged entries into the database (1.17.5
> would
> still segfault).

Interesting - I tried to repro, but so far to no avail. Will check and
fix.

>
> I then just moved those three binaries in /sbin to .orig and copied
> across the
> ones for 1.18.0 into /sbin, then did the "service rsyslog start" and
> all worked:
>
> Aug 8 01:11:37 server rsyslogd: [origin software="rsyslogd"
> swVersion="1.18.0" x-pid="15789"][x-configInfo udpReception="No"
> udpPort="514"
> tcpReception="No" tcpPort="0"] restart
> Aug 8 01:11:37 server rsyslogd:To enable MySQL logging, a "$ModLoad
> MySQL"
> must be done - accepted for the time being, but will fail in future
> releases.
> Aug 8 01:11:37 server rsyslog: rsyslogd startup succeeded
> Aug 8 01:11:37 server rsyslog: rklogd startup succeeded
> Aug 8 01:11:37 server kernel: rklogd 1.18.0, log source = /proc/kmsg
> started.
>
> where:
>
> # rsyslogd -v
> rsyslogd 1.18.0, compiled with:
> FEATURE_PTHREADS (dual-threading)
> FEATURE_REGEXP
> FEATURE_DB
> FEATURE_LARGEFILE
> FEATURE_NETZIP (syslog message compression)
> SYSLOG_INET (Internet/remote support)
>
> See http://www.rsyslog.com for more information.
>
> and:
>
> # ldd rsyslogd |grep mysql
> libmysqlclient.so.14 => /usr/lib/mysql/libmysqlclient.so.14
> (0x004fb000)
>
> and I see the entries getting logged into the SystemEvents table.
>
> >From here phpLogCon shows:
>
> 5 most recent logs (filter settings apply):
>
> No data found!
>
> Note: There are 23 events in the database, which are in the future!

I think the "future problem" is probably related to your environment.
This is most probably the clock skew that make also complained about.

>
> ie. there are events in the database which I can't view, but now this
> may be
> due to a database change between 1.17.5 and 1.18.0 ??

No, its unchanged for at least a year.

>
> It's too late in the morning now so I'll carry on with this tomorrow
> sometime.
> But if you have suggestions on what could be wrong with phpLogCon (ie.
> why I'm
> not actually viewing the entries even though events do exist) please
> let me know.
>

I'd appreciate if you could post the phpLogCon issue (just copy and
paste) to

http://www.phplogcon.org/PNphpBB2.phtml

I am right now way to disconnected from it - there are other folks who
can probably help, but they are not necessarily reading this list ;)

Thanks for your patience and help in getting rsyslog as bug-free as
possible!

Rainer
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
> > Yes, I think so. I remember there was some discussion around this.
> I'll
> > try to find you the bugzilla ticket where this was discussed.
>
> Ok.

Here it is:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=243831

Please note that output modularization is complete. Plug-ins, however
are not yet defined and will probably not be before fall.

Rainer
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
Hi Rainer,

> Hi Michael,
>
> > -----Original Message-----
> > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> > bounces at lists.adiscon.com] On Behalf Of Michael Mansour
> > Sent: Tuesday, August 07, 2007 5:19 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] Is rsyslog 1.17.5 RPM MySQL capable?
> >
> > Hi Rainer,
> >
> > > Michael,
> > >
> > > glad you got that far. I think output modularization brought up an
> > > old issue again: Add a semicolon to the end of the db action line.
> > > The MySQL command line parser is pretty old and could need an
> > > upgrade. I've stayed away from that, because it will be replaced
> > > when we do a new config file format. I'd appreciate if you could
> > > try. I'll also try to repro your bug, but I need to finish something
> > > else first.
> > >
> > > So the line should be like
> > >
> > > *.*
> > > >database-server,database-name,database-userid,database-password;
> > >
> > > NOTE THE END OF THE LINE!
> >
> > Yes that was spot on. I added the semicolon for 1.18.0, ran the debug
> > and it
> > went through and (finally) logged entries into the database (1.17.5
> > would
> > still segfault).
>
> Interesting - I tried to repro, but so far to no avail. Will check
> and fix.
>
> >
> > I then just moved those three binaries in /sbin to .orig and copied
> > across the
> > ones for 1.18.0 into /sbin, then did the "service rsyslog start" and
> > all worked:
> >
> > Aug 8 01:11:37 server rsyslogd: [origin software="rsyslogd"
> > swVersion="1.18.0" x-pid="15789"][x-configInfo udpReception="No"
> > udpPort="514"
> > tcpReception="No" tcpPort="0"] restart
> > Aug 8 01:11:37 server rsyslogd:To enable MySQL logging, a "$ModLoad
> > MySQL"
> > must be done - accepted for the time being, but will fail in future
> > releases.
> > Aug 8 01:11:37 server rsyslog: rsyslogd startup succeeded
> > Aug 8 01:11:37 server rsyslog: rklogd startup succeeded
> > Aug 8 01:11:37 server kernel: rklogd 1.18.0, log source = /proc/kmsg
> > started.
> >
> > where:
> >
> > # rsyslogd -v
> > rsyslogd 1.18.0, compiled with:
> > FEATURE_PTHREADS (dual-threading)
> > FEATURE_REGEXP
> > FEATURE_DB
> > FEATURE_LARGEFILE
> > FEATURE_NETZIP (syslog message compression)
> > SYSLOG_INET (Internet/remote support)
> >
> > See http://www.rsyslog.com for more information.
> >
> > and:
> >
> > # ldd rsyslogd |grep mysql
> > libmysqlclient.so.14 => /usr/lib/mysql/libmysqlclient.so.14
> > (0x004fb000)
> >
> > and I see the entries getting logged into the SystemEvents table.
> >
> > >From here phpLogCon shows:
> >
> > 5 most recent logs (filter settings apply):
> >
> > No data found!
> >
> > Note: There are 23 events in the database, which are in the future!
>
> I think the "future problem" is probably related to your environment.
> This is most probably the clock skew that make also complained about.

I worked out why there was the clock skew. Basically I was running the compile
on an nfs mount point, and the server doing the nfs export was in the future
(I hadn't finished the ntp setup on it). I fixed the ntp setup on the nfs
exported server, and after a few minutes it synced correctly in time with
every other server.

I also extracted the 1.18.0 tarball into a local filesystem on the server
running rsyslog, and the make went through fine without any clock skew.

I then moved those newly generated rsyslog files to the /sbin directory, and
started rsyslog and it's logging to the database.

Currently the database has (from phpLogcon):

5 most recent logs (filter settings apply):

No data found!

Note: There are 2142 events in the database, which are in the future!

I'm not sure why it still says "in the future", so what I did was stop
rsyslog, truncate the systemevents table, restart rsyslog, and still got:

5 most recent logs (filter settings apply):

No data found!

Note: There are 11 events in the database, which are in the future!

I know you provided me with a link to a forum on this, so I'll try and take
this issue with phpLogCon up there.

Do you know of any other software I can use which does was phpLogCon does? so
that I can allow user accounts to login and show syslog events from the web?

> > ie. there are events in the database which I can't view, but now this
> > may be
> > due to a database change between 1.17.5 and 1.18.0 ??
>
> No, its unchanged for at least a year.

Ok, that rules out that problem out then.

> > It's too late in the morning now so I'll carry on with this tomorrow
> > sometime.
> > But if you have suggestions on what could be wrong with phpLogCon (ie.
> > why I'm
> > not actually viewing the entries even though events do exist) please
> > let me know.
> >
>
> I'd appreciate if you could post the phpLogCon issue (just copy and
> paste) to
>
> http://www.phplogcon.org/PNphpBB2.phtml
>
> I am right now way to disconnected from it - there are other folks
> who can probably help, but they are not necessarily reading this
> list ;)

I'll do this now.

> Thanks for your patience and help in getting rsyslog as bug-free as
> possible!

My pleasure Rainer, your software is also immensely helpful for what I need to
get out of it too, so anything I can do to make it better...

Michael.

> Rainer
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
------- End of Original Message -------
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
Hi Rainer,

> > > -----Original Message-----
> > > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> > > bounces at lists.adiscon.com] On Behalf Of Michael Mansour
> > > Sent: Tuesday, August 07, 2007 5:19 PM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] Is rsyslog 1.17.5 RPM MySQL capable?
> > >
> > > Hi Rainer,
> > >
> > > > Michael,
> > > >
> > > > glad you got that far. I think output modularization brought up an
> > > > old issue again: Add a semicolon to the end of the db action line.
> > > > The MySQL command line parser is pretty old and could need an
> > > > upgrade. I've stayed away from that, because it will be replaced
> > > > when we do a new config file format. I'd appreciate if you could
> > > > try. I'll also try to repro your bug, but I need to finish something
> > > > else first.
> > > >
> > > > So the line should be like
> > > >
> > > > *.*
> > > > >database-server,database-name,database-userid,database-password;
> > > >
> > > > NOTE THE END OF THE LINE!
> > >
> > > Yes that was spot on. I added the semicolon for 1.18.0, ran the debug
> > > and it
> > > went through and (finally) logged entries into the database (1.17.5
> > > would
> > > still segfault).
> >
> > Interesting - I tried to repro, but so far to no avail. Will check
> > and fix.
> >
> > > I then just moved those three binaries in /sbin to .orig and copied
> > > across the
> > > ones for 1.18.0 into /sbin, then did the "service rsyslog start" and
> > > all worked:
> > >
> > > Aug 8 01:11:37 server rsyslogd: [origin software="rsyslogd"
> > > swVersion="1.18.0" x-pid="15789"][.x-configInfo udpReception="No"
> > > udpPort="514"
> > > tcpReception="No" tcpPort="0"] restart
> > > Aug 8 01:11:37 server rsyslogd:To enable MySQL logging, a "$ModLoad
> > > MySQL"
> > > must be done - accepted for the time being, but will fail in future
> > > releases.
> > > Aug 8 01:11:37 server rsyslog: rsyslogd startup succeeded
> > > Aug 8 01:11:37 server rsyslog: rklogd startup succeeded
> > > Aug 8 01:11:37 server kernel: rklogd 1.18.0, log source = /proc/kmsg
> > > started.
> > >
> > > where:
> > >
> > > # rsyslogd -v
> > > rsyslogd 1.18.0, compiled with:
> > > FEATURE_PTHREADS (dual-threading)
> > > FEATURE_REGEXP
> > > FEATURE_DB
> > > FEATURE_LARGEFILE
> > > FEATURE_NETZIP (syslog message compression)
> > > SYSLOG_INET (Internet/remote support)
> > >
> > > See http://www.rsyslog.com for more information.
> > >
> > > and:
> > >
> > > # ldd rsyslogd |grep mysql
> > > libmysqlclient.so.14 => /usr/lib/mysql/libmysqlclient.so.14
> > > (0x004fb000)
> > >
> > > and I see the entries getting logged into the SystemEvents table.
> > >
> > > >From here phpLogCon shows:
> > >
> > > 5 most recent logs (filter settings apply):
> > >
> > > No data found!
> > >
> > > Note: There are 23 events in the database, which are in the future!
> >
> > I think the "future problem" is probably related to your environment.
> > This is most probably the clock skew that make also complained about.
>
> I worked out why there was the clock skew. Basically I was running
> the compile on an nfs mount point, and the server doing the nfs
> export was in the future
> (I hadn't finished the ntp setup on it). I fixed the ntp setup on
> the nfs exported server, and after a few minutes it synced correctly
> in time with every other server.
>
> I also extracted the 1.18.0 tarball into a local filesystem on the server
> running rsyslog, and the make went through fine without any clock skew.
>
> I then moved those newly generated rsyslog files to the /sbin
> directory, and started rsyslog and it's logging to the database.

As an update to this, I modified the spec file that was in the 1.17.5 src rpm
to just look for the 1.18.0, and built the 1.18.0 binary rpm without an issue.

Regards,

Michael.

> Currently the database has (from phpLogcon):
>
> 5 most recent logs (filter settings apply):
>
> No data found!
>
> Note: There are 2142 events in the database, which are in the future!
>
> I'm not sure why it still says "in the future", so what I did was
> stop rsyslog, truncate the systemevents table, restart rsyslog, and
> still got:
>
> 5 most recent logs (filter settings apply):
>
> No data found!
>
> Note: There are 11 events in the database, which are in the future!
>
> I know you provided me with a link to a forum on this, so I'll try
> and take this issue with phpLogCon up there.
>
> Do you know of any other software I can use which does was phpLogCon
> does? so that I can allow user accounts to login and show syslog
> events from the web?
>
> > > ie. there are events in the database which I can't view, but now this
> > > may be
> > > due to a database change between 1.17.5 and 1.18.0 ??
> >
> > No, its unchanged for at least a year.
>
> Ok, that rules out that problem out then.
>
> > > It's too late in the morning now so I'll carry on with this tomorrow
> > > sometime.
> > > But if you have suggestions on what could be wrong with phpLogCon (ie.
> > > why I'm
> > > not actually viewing the entries even though events do exist) please
> > > let me know.
> > >
> >
> > I'd appreciate if you could post the phpLogCon issue (just copy and
> > paste) to
> >
> > http://www.phplogcon.org/PNphpBB2.phtml
> >
> > I am right now way to disconnected from it - there are other folks
> > who can probably help, but they are not necessarily reading this
> > list ;)
>
> I'll do this now.
>
> > Thanks for your patience and help in getting rsyslog as bug-free as
> > possible!
>
> My pleasure Rainer, your software is also immensely helpful for what
> I need to get out of it too, so anything I can do to make it better...
>
> Michael.
>
> > Rainer
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> ------- End of Original Message -------
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
------- End of Original Message -------
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
Hi Rainer,

> > Hi Michael,
> >
> > > -----Original Message-----
> > > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> > > bounces at lists.adiscon.com] On Behalf Of Michael Mansour
> > > Sent: Tuesday, August 07, 2007 5:19 PM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] Is rsyslog 1.17.5 RPM MySQL capable?
> > >
> > > Hi Rainer,
> > >
> > > > Michael,
> > > >
> > > > glad you got that far. I think output modularization brought up an
> > > > old issue again: Add a semicolon to the end of the db action line.
> > > > The MySQL command line parser is pretty old and could need an
> > > > upgrade. I've stayed away from that, because it will be replaced
> > > > when we do a new config file format. I'd appreciate if you could
> > > > try. I'll also try to repro your bug, but I need to finish something
> > > > else first.
> > > >
> > > > So the line should be like
> > > >
> > > > *.*
> > > > >database-server,database-name,database-userid,database-password;
> > > >
> > > > NOTE THE END OF THE LINE!
> > >
> > > Yes that was spot on. I added the semicolon for 1.18.0, ran the debug
> > > and it
> > > went through and (finally) logged entries into the database (1.17.5
> > > would
> > > still segfault).
> >
> > Interesting - I tried to repro, but so far to no avail. Will check
> > and fix.

I'm ignoring this 1.17.5 version now since 1.18.0 is working fine.

> > > I then just moved those three binaries in /sbin to .orig and copied
> > > across the
> > > ones for 1.18.0 into /sbin, then did the "service rsyslog start" and
> > > all worked:
> > >
> > > Aug 8 01:11:37 server rsyslogd: [origin software="rsyslogd"
> > > swVersion="1.18.0" x-pid="15789"][.x-configInfo udpReception="No"
> > > udpPort="514"
> > > tcpReception="No" tcpPort="0"] restart
> > > Aug 8 01:11:37 server rsyslogd:To enable MySQL logging, a "$ModLoad
> > > MySQL"
> > > must be done - accepted for the time being, but will fail in future
> > > releases.
> > > Aug 8 01:11:37 server rsyslog: rsyslogd startup succeeded
> > > Aug 8 01:11:37 server rsyslog: rklogd startup succeeded
> > > Aug 8 01:11:37 server kernel: rklogd 1.18.0, log source = /proc/kmsg
> > > started.
> > >
> > > where:
> > >
> > > # rsyslogd -v
> > > rsyslogd 1.18.0, compiled with:
> > > FEATURE_PTHREADS (dual-threading)
> > > FEATURE_REGEXP
> > > FEATURE_DB
> > > FEATURE_LARGEFILE
> > > FEATURE_NETZIP (syslog message compression)
> > > SYSLOG_INET (Internet/remote support)
> > >
> > > See http://www.rsyslog.com for more information.
> > >
> > > and:
> > >
> > > # ldd rsyslogd |grep mysql
> > > libmysqlclient.so.14 => /usr/lib/mysql/libmysqlclient.so.14
> > > (0x004fb000)
> > >
> > > and I see the entries getting logged into the SystemEvents table.
> > >
> > > >From here phpLogCon shows:
> > >
> > > 5 most recent logs (filter settings apply):
> > >
> > > No data found!
> > >
> > > Note: There are 23 events in the database, which are in the future!
> >
> > I think the "future problem" is probably related to your environment.
> > This is most probably the clock skew that make also complained about.
>
> I worked out why there was the clock skew. Basically I was running
> the compile on an nfs mount point, and the server doing the nfs
> export was in the future
> (I hadn't finished the ntp setup on it). I fixed the ntp setup on
> the nfs exported server, and after a few minutes it synced correctly
> in time with every other server.
>
> I also extracted the 1.18.0 tarball into a local filesystem on the server
> running rsyslog, and the make went through fine without any clock skew.
>
> I then moved those newly generated rsyslog files to the /sbin
> directory, and started rsyslog and it's logging to the database.
>
> Currently the database has (from phpLogcon):
>
> 5 most recent logs (filter settings apply):
>
> No data found!
>
> Note: There are 2142 events in the database, which are in the future!
>
> I'm not sure why it still says "in the future", so what I did was
> stop rsyslog, truncate the systemevents table, restart rsyslog, and
> still got:
>
> 5 most recent logs (filter settings apply):
>
> No data found!
>
> Note: There are 11 events in the database, which are in the future!
>
> I know you provided me with a link to a forum on this, so I'll try
> and take this issue with phpLogCon up there.
>
> Do you know of any other software I can use which does was phpLogCon
> does? so that I can allow user accounts to login and show syslog
> events from the web?
>
> > > ie. there are events in the database which I can't view, but now this
> > > may be
> > > due to a database change between 1.17.5 and 1.18.0 ??
> >
> > No, its unchanged for at least a year.
>
> Ok, that rules out that problem out then.
>
> > > It's too late in the morning now so I'll carry on with this tomorrow
> > > sometime.
> > > But if you have suggestions on what could be wrong with phpLogCon (ie.
> > > why I'm
> > > not actually viewing the entries even though events do exist) please
> > > let me know.
> > >
> >
> > I'd appreciate if you could post the phpLogCon issue (just copy and
> > paste) to
> >
> > http://www.phplogcon.org/PNphpBB2.phtml
> >
> > I am right now way to disconnected from it - there are other folks
> > who can probably help, but they are not necessarily reading this
> > list ;)
>
> I'll do this now.

Although I posted the forum post, after that I read the FAQ:

http://www.phplogcon.org/Topic3.phtml

which actually solved the problem (by turning off UTC time). That solved the
"future problem" displayed within phpLogCon and enabled me to pull rows out of
the database.

So basically, all is now working as expected and now I'm looking for the
ability to use the 1.18.0 backup mysql server feature to complete the setup
for redundancy.

Where would the docs be for this?

I'm also wondering if there are scripts around which will prune database
entries over time that I could cron? so the database doesn't keep growing ad
infinitum.

Thanks for all your assistance so far Rainer.

Michael.

> > Thanks for your patience and help in getting rsyslog as bug-free as
> > possible!
>
> My pleasure Rainer, your software is also immensely helpful for what
> I need to get out of it too, so anything I can do to make it better...
>
> Michael.
>
> > Rainer
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> ------- End of Original Message -------
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
------- End of Original Message -------
Is rsyslog 1.17.5 RPM MySQL capable? [ In reply to ]
> > > > Yes that was spot on. I added the semicolon for 1.18.0, ran the
> debug
> > > > and it
> > > > went through and (finally) logged entries into the database
> (1.17.5
> > > > would
> > > > still segfault).
> > >
> > > Interesting - I tried to repro, but so far to no avail. Will check
> > > and fix.
>
> I'm ignoring this 1.17.5 version now since 1.18.0 is working fine.

Looks like this was actually a 1.17.5 issue. I tried once again to repro
with 1.18.0, but to no avail. I think I close the bug for now. If
someone else experiences it, please speak up.

Thanks,
Rainer