Actually, I ended up doing a "LIKE" search on hostname, looking at the query via full processlist and running the query by hand, assuming it was the same, just without the "LIKE" syntax.
Turns out I had a horked index in a table that MAX(id) exposed. Fixed it and moved on. thx Andre Lorbach wrote: > One question, are you searching for a single word or a phrase? > If you are searching for a phrase, please use + instead of spaces. > For example, you want to find a syslogtag like "mysql safe", then you > use this search: > source:=mysql+safe > > If you do not use the + instead of the space, the filter will be > splitted at the word safe, which will be considered as message filter > then. > > Maybe this helps - best regards, > Andre Lorbach > > > > >> -----Original Message----- >> From: [EMAIL PROTECTED] [mailto:rsyslog- >> [EMAIL PROTECTED] On Behalf Of Rory Toma >> Sent: Thursday, August 07, 2008 2:12 AM >> To: rsyslog-users >> Subject: [rsyslog] see sql queries on phplogcon >> >> How do I see what queries are being done in phplogcon? I don't have >> > sql > >> logging turned on in my db. >> >> the := syntax seems to be no longer working for me. I get an error >> telling me there were no syslog records found when I try it. >> >> >> I've set up my SystemEvents table as a union and merged all the tables >> in with data. This shouldn't affect it, I would think. My sql queries >> > by > >> hand seem to work fine. >> >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
