[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: rsyslogd logging to MySQL Database



On 7/24/2011 6:13 PM, Leo Goehrs wrote:
Well, here, on the boat in ibiza, on my blackberry, I don't have the exact name, but we use a php-syslog software, and everything is explained.

We consolidate linux, freebsd and cisco/juniper equipments.

Just hit syslog-ng and mysql in google and you should find plenty of matches.

Leo

----- Message d'origine -----
De : debian [mailto:debian@fpsoft.net]
Envoyé : Monday, July 25, 2011 12:06 AM
À : Leo Goehrs
Cc : 'debian-isp@lists.debian.org'<debian-isp@lists.debian.org>
Objet : Re: rsyslogd logging to MySQL Database

On 7/24/2011 6:00 PM, Leo Goehrs wrote:
Of course you may, at least we do it, we have syslog sending to a gew central syslog-ng, and syslog-ng is able to log to a mysql database because it is able to correctly format the logs, then write to a fifo file, which is read by a script and inserted into the mysql database, being further more viewed using php-syslog.

Regards

Leo goehrs

Ps: we use it also to analyse apache logs on cluster configurations, ton consolidate apache logs on the fly using a non blocking technique.


Hmm, okay, that is why I want to do it this way.  We were thinking about
using Splunk, but I don't like the flat file format that is uses to
store its database.  That and I am not too keen on the searching syntax
that it uses, so would much prefer using a MySQL database for this.  Not
only for the easier searching, but for the ability to modify and expand
any web-based log searching interface that we choose to implement.

If you can point me to a decent get-started guide on how to do this
(what you used my help and would be greatly appreciated), that would be
totally awesome!

~ Robert

Hey thanks! For a decent HOWTO when I took your advice and might have to try it on a VM here to see if I can get my Debian VMs (one of which is a very active public news server) and then when that works, move that to a similar implementation to the servers where I work. Again, thank you very very much for the words of wisdom :)

~ Robert


Reply to: