Hi,
> > Hi,
> >
> > I went here:
> >
> > http://people.redhat.com/pvrabec/rpms/rsyslog/
> >
> > and grabbed the rsyslog-1.17.5-1.src.rpm RPM, I then rebuilt it and
> > installed
> > it onto an SL4.5 server (RHEL 4 U5).
> >
> > I then setup a MySQL database, and setup the /etc/rsyslog.conf file to
> > output
> > to that database based on the instructions here:
> >
> > http://www.rsyslog.com/module-Static_Docs-view-f-
> > rsyslog_mysql.html.phtml
> >
> > After all that, I setup phpLogCon.
> >
> > After all that, I see no entries getting logged into the MySQL
> database
> > by
> > rsyslog. I've checked every step from the beginning and can only come
> > to the
> > assumption that the rsyslog RPM above is not compiled with MySQL
> > support??
> >
> > Is this assumption valid and if so, why didn't the Red Hat person also
> > make a
> > mysql one?
>
> Yes, I think so. I remember there was some discussion around this. I'll
> try to find you the bugzilla ticket where this was discussed.
> >
> > I'm guessing now I need to install from tarball? (I'd prefer RPM which
> > is why
> > I started there first).
>
> I am not much into the RPM thing ;) If you have the source available
> inside the RPM try, you can eventually do a
>
> ./configure --enable-mysql
>
> >
> > Any way I can see what the /sbin/rsyslog binary is compiled with?
>
> rsyslog -v
>
> will show the compile-time settings.
>
> This for now, will follow-up soon.
> Rainer
I've made progress but unfortunately rsyslogd ends up segfaulting when trying
to run in mysql mode.
I took the rsyslog-1.17.5-1.src.rpm file and installed it, modified the
/usr/src/redhat/SPECS/rsyslog.spec file to add:
%configure --sbindir=%{sbindir} --enable-mysql
to the configure line, this then compiled a mysql enabled version (checked
with ldd).
However, when try to start rsyslogd with the
*.* >database-server,database-name,database-userid,database-password
entry (filled out to my details) as the last line in /etc/rsyslog.conf, the
start up hangs. When I comment out the line above, the startup succeeds.
When I run this in debug to see what's going on, pages of stuff ending with:
Messages with malicious PTR DNS Records are not dropped.
Control characters are replaced upon reception.
Control character escape sequence prefix is '#'.
-1208325536: logmsg: syslog.info<46>, flags 5, from '', msg [origin
software="rsyslogd" swVersion="1.17.5" x-pid="11790"][x-configInfo
udpReception="No" udpPort="514" tcpReception="No" tcpPort="0"] restart
-1208325536: Message has legacy syslog format.
-1208325536: enqueueMsg: not yet running on multiple threads
-1208325536: Called fprintlog, logging to builtin-file (/var/log/messages)
-1208325536: Called fprintlog, logging to builtin-mysqlSegmentation fault
a segmentation fault.
When I try the same thing with the rsyslog-1.18.0 I compiled earlier:
[root at server rsyslog-1.18.0]# ./rsyslogd -m 0 -x -d
I get this logged into the messages file:
Aug 8 00:48:41 server rsyslogd: [origin software="rsyslogd"
swVersion="1.18.0" x-pid="12621"][x-configInfo udpReception="No" udpPort="514"
tcpReception="No" tcpPort="0"] restart
Aug 8 00:48:41 server rsyslogd:To enable MySQL logging, a "$ModLoad MySQL"
must be done - accepted for the time being, but will fail in future releases.
Aug 8 00:48:41 server rsyslogd:invalid character in selector line -
';template' expected
Aug 8 00:48:41 server rsyslogd:the last error occured in /etc/rsyslog.conf,
line 31
Aug 8 00:48:41 server rsyslogd:warning: selector line without actions will be
discarded
but that may be due to not actually doing a "make install" of 1.18.0 where the
klogd and rfc3195d files installed in the OS are for 1.17.5.
If they're not, does it give us a clue to the problem?
Thanks,
Michael.