On Fri, 12 Jun 2015, Patrick Slattery wrote:
Hi, I'm trying to get log data from rsyslogd to a MS SQL Server Express
2014 instance but I'm having a hell of a time getting it to work.
I'm on CentOS v6.6 and I recompiled rsyslog from source with
--enable-libdbi so that the omlibdbi option would work.
# rsyslogd -v
rsyslogd 8.11.0.master, compiled with:
PLATFORM: x86_64-unknown-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
Number of Bits in RainerScript integers: 64
Contents of /etc/myapp-rsyslog.cfg are:
$ModLoad imudp
$UDPServerAddress 127.0.0.1
$UDPServerRun 514
module (load="omlibdbi")
template (name="MSSQLformat" type="string" option.sql="on" string="insert
into dbo.myapp (host, msg) values ('%HOSTNAME%', '%msg%')")
*.* action (type="omlibdbi" server="server.company.com" db="Syslog"
uid="sa" pwd="password" template="MSSQLformat" driver="freetds")
Running:
# /usr/local/sbin/rsyslogd -N1 -f /etc/my_rsyslog-log.cfg
gives:
rsyslogd: version 8.11.0.master, config validation run (level 1), master
config /etc/myapp-rsyslog.cfg
rsyslogd: End of config validation run. Bye.
So it would appear that the conf file is valid.
I can definitely connect to the SQL DB from the rsyslog server:
# TDSVER=7.1 tsql -H server.company.com -p 1433 -U sa -P "password"
1> EXEC sp_databases
2> go
DATABASE_NAME DATABASE_SIZE REMARKS
master 6400 NULL
model 2752 NULL
msdb 14976 NULL
Syslog 204800 NULL
tempdb 2560 NULL
(5 rows affected)
(return status = 0)
When I run rsyslogd interactively I get:
# /sbin/rsyslogd -f /etc/myapp-rsyslog.cfg -dn
6817.343677791:main Q:Reg/w0 : action 'action 0': called, logging to
omlibdbi (susp 0/0, direct q 1)
6817.343681180:main Q:Reg/w0 : action 'action 0': is transactional -
executing in commit phase
6817.343684163:main Q:Reg/w0 : actionTryResume: action 0x7f3217e60490
state: susp, next retry (if applicable): 1434086847 [now 1434086817]
6817.343686762:main Q:Reg/w0 : action 'action 0': set suspended state to 1
6817.343689186:main Q:Reg/w0 : processBATCH: next msg 1: can not
initialize libdbi connection [v8.10.0.ad1 try http://www.rsyslog.com/e/2007
]
so this is saying that it can't initialize the connection to MSSQL, it would be
worth looking in the logs of MSSQL to see what it has to say. Is is even seeing
the connection attempt? if it is, is it complaining about a login failure? or is
the login succeeding and it's failing to select a database? or doesn't have
permission to insert into the database? or is sending a malformed command when
it's trying to insert.....
David Lang
6817.343691543:main Q:Reg/w0 : ACTION 0
[omlibdbi:action(type="omlibdbi" ...)]
6817.343696392:main Q:Reg/w0 : executing action 0
6817.343698956:main Q:Reg/w0 : action 'action 0': called, logging to
omlibdbi (susp 0/1, direct q 1)
6817.343702170:main Q:Reg/w0 : action 'action 0': is transactional -
executing in commit phase
6817.343705075:main Q:Reg/w0 : actionTryResume: action 0x7f3217e60490
state: susp, next retry (if applicable): 1434086847 [now 1434086817]
6817.343707610:main Q:Reg/w0 : action 'action 0': set suspended state to 1
and nothing shows up in the DB.
Any ideas on what I'm doing wrong here? (Other than the obvious of using MS
SQL ;-)
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
