Skip to content

Commit 62426cd

Browse files
cigamitcigamit
committed
Resolving Issue #`103
Allow syslog to use rsyslog new tizezone sensitive timestamps instead of legacy date/time
1 parent 0d15fca commit 62426cd

5 files changed

Lines changed: 35 additions & 20 deletions

File tree

‎README.md‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,22 @@ Note: You must rename config.php.dist in the syslog plugin directory to config.p
2929

3030
If you are upgrading to 2.0 from a prior install, you must first uninstall syslog and insure both the syslog, syslog_removal, and syslog_incoming tables are removed, and recreated at install time.
3131

32-
In addtion, the rsyslog configuration has changed in 2.0. So, for example, to configure modern rsyslog for Cacti, you must create a file called cacti.conf in the /etc/rsyslog.d/ directory that includes the following:
32+
In addtion, the rsyslog configuration has changed in 2.5. So, for example, to configure modern rsyslog for Cacti, you MUST create a file called cacti.conf in the /etc/rsyslog.d/ directory that includes the following:
33+
34+
--------------------- start /etc/rsyslog.d/cacti.conf ---------------------
35+
36+
$ModLoad imudp
37+
$UDPServerRun 514
38+
$ModLoad ommysql
39+
40+
$template cacti_syslog,"INSERT INTO syslog_incoming(facility_id, priority_id, program, logtime, host, message) \
41+
values (%syslogfacility%, %syslogpriority%, '%programname%', '%timegenerated%', '%HOSTNAME%', TRIM('%msg%'))", SQL
42+
43+
*.* >localhost,my_database,my_user,my_password;cacti_syslog
44+
45+
--------------------- end /etc/rsyslog.d/cacti.conf ---------------------
46+
47+
This is a change from versions 2.0 to 2.4 and below, which had the following file format:
3348

3449
--------------------- start /etc/rsyslog.d/cacti.conf ---------------------
3550

@@ -44,6 +59,8 @@ In addtion, the rsyslog configuration has changed in 2.0. So, for example, to c
4459

4560
--------------------- end /etc/rsyslog.d/cacti.conf ---------------------
4661

62+
If you are upgrading to version 2.5 from an earlier version, make sure that you update this template format and restart rsyslog. You may loose some syslog data, but doing this in a timely fashion, will minimize data loss.
63+
4764
Ensure you restart rsyslog after these changes are completed. Other logging servers such as Syslog-NG are also supported with this plugin. Please see some additional documentation here: [Cacti Documentation Site](https://docs.cacti.net/plugin:syslog.config)
4865

4966
We are using the pure integer values that rsyslog provides to both the priority and facility in this version syslog, which makes the data collection must less costly for the database. We have also started including the 'program' syslog column for searching and storage and alert generation.
@@ -81,6 +98,7 @@ The sylog plugin has been in development for well over a decade with increasing
8198

8299
* issue#102: Syslog statistics filter problem - select program
83100
* issue#101: Alert rule SQL Expression not working as expected
101+
* issue#103: Allow syslog to use rsyslog new tizezone sensitive timestamps instead of legacy date/time
84102
* issue#100: Fix odd/even classes generation in report
85103
* issue#99: Re-Alert Cycle (Alert Rules) is wrong in case of 1 minute poller interval
86104
* issue#96: Syslog filtering does not work with some international characters

‎config.php.dist‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,7 @@ if (!$use_cacti_db) {
6464
//$syslog_install_options['id'] = 'syslog';
6565

6666
/* field in the incomming table */
67-
$syslog_incoming_config['dateField'] = 'date';
68-
$syslog_incoming_config['timeField'] = 'time';
67+
$syslog_incoming_config['timeField'] = 'logtime';
6968
$syslog_incoming_config['priorityField'] = 'priority_id';
7069
$syslog_incoming_config['facilityField'] = 'facility_id';
7170
$syslog_incoming_config['hostField'] = 'host_id';

‎functions.php‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -246,8 +246,7 @@ function syslog_remove_items($table, $uniqueID) {
246246
if ($remove['method'] != 'del') {
247247
$sql1 = 'INSERT INTO `' . $syslogdb_default . '`.`syslog_removed`
248248
(logtime, priority_id, facility_id, program_id, host_id, message)
249-
SELECT TIMESTAMP(`' . $syslog_incoming_config['dateField'] . '`, `' . $syslog_incoming_config['timeField'] . '`),
250-
priority_id, facility_id, program_id, host_id, message
249+
SELECT logtime, priority_id, facility_id, program_id, host_id, message
251250
FROM (SELECT si.date, si.time, si.priority_id, si.facility_id, spg.program_id, sh.host_id, si.message
252251
FROM `' . $syslogdb_default . '`.`syslog_incoming` AS si
253252
INNER JOIN `' . $syslogdb_default . '`.`syslog_facilities` AS sf
@@ -290,8 +289,7 @@ function syslog_remove_items($table, $uniqueID) {
290289
if ($remove['method'] != 'del') {
291290
$sql1 = 'INSERT INTO `' . $syslogdb_default . '`.`syslog_removed`
292291
(logtime, priority_id, facility_id, program_id, host_id, message)
293-
SELECT TIMESTAMP(`' . $syslog_incoming_config['dateField'] . '`, `' . $syslog_incoming_config['timeField'] . '`),
294-
priority_id, facility_id, program_id, host_id, message
292+
SELECT logtime, priority_id, facility_id, program_id, host_id, message
295293
FROM (SELECT si.date, si.time, si.priority_id, si.facility_id, spg.program_id, sh.host_id, si.message
296294
FROM `' . $syslogdb_default . '`.`syslog_incoming` AS si
297295
INNER JOIN `' . $syslogdb_default . '`.`syslog_facilities` AS sf
@@ -334,8 +332,7 @@ function syslog_remove_items($table, $uniqueID) {
334332
if ($remove['method'] != 'del') {
335333
$sql1 = 'INSERT INTO `' . $syslogdb_default . '`.`syslog_removed`
336334
(logtime, priority_id, facility_id, program_id, host_id, message)
337-
SELECT TIMESTAMP(`' . $syslog_incoming_config['dateField'] . '`, `' . $syslog_incoming_config['timeField'] . '`),
338-
priority_id, facility_id, program_id, host_id, message
335+
SELECT logtime, priority_id, facility_id, program_id, host_id, message
339336
FROM (SELECT si.date, si.time, si.priority_id, si.facility_id, spg.program_id, sh.host_id, si.message
340337
FROM `' . $syslogdb_default . '`.`syslog_incoming` AS si
341338
INNER JOIN `' . $syslogdb_default . '`.`syslog_facilities` AS sf
@@ -374,8 +371,7 @@ function syslog_remove_items($table, $uniqueID) {
374371
if ($remove['method'] != 'del') {
375372
$sql1 = 'INSERT INTO `' . $syslogdb_default . '`.`syslog_removed`
376373
(logtime, priority_id, facility_id, program_id, host_id, message)
377-
SELECT TIMESTAMP(`' . $syslog_incoming_config['dateField'] . '`, `' . $syslog_incoming_config['timeField'] . '`),
378-
priority_id, facility_id, program_id, host_id, message
374+
SELECT logtime, priority_id, facility_id, program_id, host_id, message
379375
FROM (SELECT si.date, si.time, si.priority_id, si.facility_id, spg.program_id, sh.host_id, si.message
380376
FROM `' . $syslogdb_default . '`.`syslog_incoming` AS si
381377
INNER JOIN `' . $syslogdb_default . '`.`syslog_facilities` AS sf
@@ -414,8 +410,7 @@ function syslog_remove_items($table, $uniqueID) {
414410
if ($remove['method'] != 'del') {
415411
$sql1 = 'INSERT INTO `' . $syslogdb_default . '`.`syslog_removed`
416412
(logtime, priority_id, facility_id, program_id, host_id, message)
417-
SELECT TIMESTAMP(`' . $syslog_incoming_config['dateField'] . '`, `' . $syslog_incoming_config['timeField'] . '`),
418-
priority_id, facility_id, program_id, host_id, message
413+
SELECT logtime, priority_id, facility_id, program_id, host_id, message
419414
FROM (SELECT si.date, si.time, si.priority_id, si.facility_id, spg.program_id, sh.host_id, si.message
420415
FROM `' . $syslogdb_default . '`.`syslog_incoming` AS si
421416
INNER JOIN `' . $syslogdb_default . '`.`syslog_facilities` AS sf
@@ -454,8 +449,7 @@ function syslog_remove_items($table, $uniqueID) {
454449
if ($remove['method'] != 'del') {
455450
$sql1 = 'INSERT INTO `' . $syslogdb_default . '`.`syslog_removed`
456451
(logtime, priority_id, facility_id, program_id, host_id, message)
457-
SELECT TIMESTAMP(`' . $syslog_incoming_config['dateField'] . '`, `' . $syslog_incoming_config['timeField'] . '`),
458-
priority_id, facility_id, program_id, host_id, message
452+
SELECT logtime, priority_id, facility_id, program_id, host_id, message
459453
FROM (SELECT si.date, si.time, si.priority_id, si.facility_id, spg.program_id, sh.host_id, si.message
460454
FROM `' . $syslogdb_default . '`.`syslog_incoming` AS si
461455
INNER JOIN `' . $syslogdb_default . '`.`syslog_facilities` AS sf

‎setup.php‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,12 @@ function syslog_check_upgrade() {
276276
'default' => '',
277277
'after' => 'id')
278278
);
279+
280+
if (db_column_exists('syslog_incoming', 'date')) {
281+
db_execute("ALTER TABLE syslog_incoming
282+
DROP COLUMN date,
283+
CHANGE COLUMN `time` logtime timestamp default '0000-00-00';");
284+
}
279285
}
280286

281287
$alerts = syslog_db_fetch_assoc('SELECT * FROM syslog_alert WHERE hash IS NULL OR hash = ""');
@@ -441,8 +447,7 @@ function syslog_setup_table_new($options) {
441447
facility_id int(10) unsigned default NULL,
442448
priority_id int(10) unsigned default NULL,
443449
program varchar(40) default NULL,
444-
`date` date default NULL,
445-
`time` time default NULL,
450+
logtime TIMESTAMP NOT NULL DEFAULT '0000-00-00 00:00:00',
446451
host varchar(64) default NULL,
447452
message varchar(1024) NOT NULL DEFAULT '',
448453
seq bigint unsigned NOT NULL auto_increment,

‎syslog_process.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -490,9 +490,8 @@
490490
/* move syslog records to the syslog table */
491491
syslog_db_execute('INSERT INTO `' . $syslogdb_default . '`.`syslog`
492492
(logtime, priority_id, facility_id, program_id, host_id, message)
493-
SELECT TIMESTAMP(`' . $syslog_incoming_config['dateField'] . '`, `' . $syslog_incoming_config['timeField'] . '`),
494-
priority_id, facility_id, program_id, host_id, message
495-
FROM (SELECT date, time, priority_id, facility_id, sp.program_id, sh.host_id, message
493+
SELECT logtime, priority_id, facility_id, program_id, host_id, message
494+
FROM (SELECT logtime, priority_id, facility_id, sp.program_id, sh.host_id, message
496495
FROM syslog_incoming AS si
497496
INNER JOIN syslog_hosts AS sh
498497
ON sh.host=si.host

0 commit comments

Comments
 (0)