Cactiusers.org

Hello jimmy,

ou have posted a plugin version of harlequin's sysload monitoring addon:

Can you tell me how i can implement this plugin ?

Thanks ind advance.

Pumpi

This could get a little complex, depending on whether you are wanting to just look at the local syslog, or pull from remotes.

Personally, I am using MSYSLOG to record to the SQL database, there are some fairly easy directions here.
Remote Syslog with MySQL and PHP. But you could just as easily use syslog-ng, but I never had any luck with it.

Once you have MSyslog up and running, I use NTSyslog to send syslog messages from my windows hosts everytime there is a Event.

I will probably put up a long list of instructions eventually, but at this time it would take a lot of work since my Notes aren't in order.

Ive just implimented that plugin.

It works great and is easy to install on Linux/unix.
I use syslog-ng to collect logs from linux windows cisco etc to a central server. From there I used a script to load the data to a mysql db

#!/bin/bash

if [ -e /var/nms/mysql.pipe ]; then
while [ -e /var/nms/mysql.pipe ]
do
mysql -u freddy --password=blahblah haloe < /var/nms/mysql.pipe
done
else
mkfifo /var/nms/mysql.pipe
fi

I keep mine in /usr/local/bin/mysql.fifo

You will need the following in your syslog-ng.conf
A destination statement like the following
##Start mysql destination statement
destination d_mysql {
pipe("/var/nms/mysql.pipe"
template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg)
VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); };
##End mysql destination statement


A Source statement (usually near the top of the file
##Start source statement
source s_udp { udp(); };
##end source statement

and a logging statement
##Start log statement
log { source(s_udp); destination(d_mysql); };
## End log statement

build the database using the sql script supplied
change your permissions on the database structure
Add the plugin using the normal method

start the /usr/local/bin/mysql.fifo script

reload your syslog-ng

you sould be right from that point. It takes a while to populate but you will see logs soon

Best of luck

Brett Stevens

Hi

Thanks for the howto, could you post the whole syslog-ng.conf file?

Thanks
Michael

When you install syslog-ng it is pretty sensibly configured, however .....

options { sync (0);
time_reopen (10);
log_fifo_size (100);
long_hostnames (on);
use_dns (yes);
use_fqdn (yes);
create_dirs (yes);
keep_hostname (yes);
chain_hostnames (no);
time_reap(12);
gc_busy_threshold(768);
perm(0644);
};
source s_sys { unix-stream ("/dev/log"); internal(); };
source s_udp { udp(); };
source s_tcp { tcp(); };
source s_local { internal(); };
destination d_mysql {
pipe("/var/nms/mysql.pipe"
template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg)
VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); };

log { source(s_udp); destination(d_mysql); };



this should work but it may need a little tweaking.

thanks

Brett Stevens (forgot my password...... neet to reset some time.)

hi Brett,


Thanks for the excellent how to I was able to setup the plugin doing some minor tweaking. I have a question
when I start the mysql.fifo i get these messages

ERROR 1062 (23000) at line 1: Duplicate entry '26' for key 1
ERROR 1062 (23000) at line 1: Duplicate entry '26' for key 1
ERROR 1062 (23000) at line 1: Duplicate entry '26' for key 1
ERROR 1062 (23000) at line 1: Duplicate entry '4' for key 1
ERROR 1062 (23000) at line 1: Duplicate entry '26' for key 1
ERROR 1062 (23000) at line 1: Duplicate entry '26' for key 1
ERROR 1062 (23000) at line 1: Duplicate entry '4' for key 1
ERROR 1062 (23000) at line 1: Duplicate entry '26' for key 1

is this ok

and one other thing how can I make the mysql.fifo run as a service

thank you in advance.
indee