2
<title>Using php-syslog-ng with rsyslog</title>
3
<meta name="KEYWORDS" content="syslog, php-syslog-ng, mysql, howto, rsyslog">
6
<h1>Using php-syslog-ng with rsyslog</h1>
7
<P><small><i>Written by
8
<a href="http://www.adiscon.com/en/people/rainer-gerhards.php">Rainer
9
Gerhards</a> (2005-08-04)</i></small></P>
10
<p><b>Note: it has been reported that this guide is somewhat outdated. Please
11
use with care. </b></p>
13
<p><i><b>In this paper, I describe how to use
14
<a href="http://www.vermeer.org/projects/php-syslog-ng">php-syslog-ng</a> with
15
<a href="http://www.rsyslog.com/">rsyslogd</a>. </b> Php-syslog-ng is a
16
popular web interface to syslog data. Its name stem from the fact that it
17
usually picks up its data from a database created by
18
<a href="http://www.balabit.com/products/syslog_ng/">syslog-ng</a> and some
19
helper scripts. However, there is nothing syslog-ng specific in the database.
20
With rsyslogd's high customizability, it is easy to write to a syslog-ng like
21
schema. I will tell you how to do this, enabling you to use php-syslog-ng as a
22
front-end for rsyslogd - or save the hassle with syslog-ng database
23
configuration and simply go ahead and use rsyslogd instead.</i></p>
24
<h2>Overall System Setup</h2>
25
<p>The setup is pretty straightforward. Basically, php-syslog-ng's interface to
26
the syslogd is the database. We use the schema that php-syslog-ng expects and
27
make rsyslogd write to it in its format. Because of this, php-syslog-ng does not
28
even know there is no syslog-ng present.</p>
29
<h2>Setting up the system</h2>
30
<p>For php-syslog-ng, you can follow its usual setup instructions. Just skip any
31
steps refering to configure syslog-ng. Make sure you create the database schema
32
in <a href="http://www.mysql.com/">MySQL</a>. As of this writing, the expected schema can be created via this script:</p>
34
<code>CREATE DATABASE syslog<br>
38
CREATE TABLE logs (<br>
39
host varchar(32) default NULL,<br>
40
facility varchar(10) default NULL,<br>
41
priority varchar(10) default NULL,<br>
42
level varchar(10) default NULL,<br>
43
tag varchar(10) default NULL,<br>
44
date date default NULL,<br>
45
time time default NULL,<br>
46
program varchar(15) default NULL,<br>
48
seq int(10) unsigned NOT NULL auto_increment,<br>
49
PRIMARY KEY (seq),<br>
52
KEY program (program),<br>
55
KEY priority (priority),<br>
56
KEY facility (facility)<br>
59
<p>Please note that at the time you are reading this paper, the schema might have changed.
60
Check for any differences. As we customize rsyslogd to the schema, it is vital
61
to have the correct one. If this paper is outdated,
62
<a href="mailto:rgerhards@adiscon.com">let me know</a> so that I can fix it.</p>
63
<p>Once this schema is created, we simply instruct rsyslogd to store received
64
data in it. I wont go into too much detail here. If you are interested in some
65
more details, you might find my paper "<a href="rsyslog_mysql.html">Writing
66
syslog messages to MySQL</a>" worth reading. For this article, we simply modify
67
<a href="rsyslog_conf.html">rsyslog.conf </a>so that it writes to the database.
68
That is easy. Just these two lines are needed:</p>
70
<code><font color="green">$template syslog-ng,"insert into logs(host, facility, priority, tag, date,
71
time, msg) values ('%HOSTNAME%', %syslogfacility%, %syslogpriority%,
72
'%syslogtag%', '%timereported:::date-mysql%', '%timereported:::date-mysql%',
73
'%msg%')", SQL</font> <br>
74
<font color="red">*.* >mysql-server,syslog,user,pass;syslog-ng</font>
77
<p>These are just <b>two</b> lines. I have color-coded them so that you see what
78
belongs together (the colors have no other meaning). The green line is the
79
actual SQL statement being used to take care of the syslog-ng schema. Rsyslogd
80
allows you to fully control the statement sent to the database. This allows you
81
to write to any database format, including your homegrown one (if you so desire).
82
Please note that there is a small inefficiency in our current usage: the
83
<code><font color="green">'%timereported:::date-mysql%'</font></code>
84
property is used for both the time and the date (if you wonder about what all
85
these funny characters mean, see the <a href="property_replacer.html">rsyslogd
86
property replacer manual</a>) . We could have extracted just the date and time
87
parts of the respective properties. However, this is more complicated and also
88
adds processing time to rsyslogd's processing (substrings must be extracted). So we take a full mysql-formatted timestamp and supply it to MySQL. The sql engine in turn
89
discards the unneeded part. It works pretty well. As of my understanding, the
90
inefficiency of discarding the unneeded part in MySQL is lower than the
91
effciency gain from using the full timestamp in rsyslogd. So it is most probably
92
the best solution.</p>
93
<p>Please note that rsyslogd knows two different timestamp properties: one is
94
timereported, used here. It is the timestamp from the message itself. Sometimes
95
that is a good choice, in other cases not. It depends on your environment. The other one is the timegenerated
96
property. This is the time when rsyslogd received the message. For obvious
97
reasons, that timestamp is consistent, even when your devices are in multiple
98
time zones or their clocks are off. However, it is not "the real thing". It's
99
your choice which one you prefer. If you prefer timegenerated ... simply use it
101
<p>The line in red tells rsyslogd which messages to log and where to store it.
102
The "*.*" selects all messages. You can use standard syslog selector line filters here if
103
you do not like to see everything in your database. The ">" tells
104
rsyslogd that a MySQL connection
105
must be established. Then, "mysql-server" is the name or IP address of the
106
server machine, "syslog" is the database name (default from the schema) and "user"
107
and "pass" are the logon credentials. Use a user with low privileges, insert into the
108
logs table is sufficient. "syslog-ng" is the template name and tells rsyslogd to
109
use the SQL statement shown above.</p>
110
<p>Once you have made the changes, all you need to do is reload (or HUP)
111
rsyslogd. Then, you should see syslog messages flow into your database - and
112
show up in php-syslog-ng.</p>
114
<P>With minumal effort, you can use php-syslog-ng together with rsyslogd. For
115
those unfamiliar with syslog-ng, this configuration is probably easier to set up
116
then switching to syslog-ng. For existing rsyslogd users, php-syslog-ng might be a nice
117
add-on to their logging infrastructure.</P>
118
<P>Please note that the <a href="http://www.monitorware.com/en/">MonitorWare family</a> (to which rsyslog belongs) also
119
offers a web-interface: <a href="http://www.phplogcon.org/">phpLogCon</a>. At the time of this writing, phpLogCon's code
120
is by far not as clean as I would like it to be. Also the user-interface is
121
definitely not as intutive as pp-syslog-ng. From a functionality point of view,
122
however, I think it already is a bit ahead. So you might
123
consider using it. I have set up a <a href="http://demo.rsyslog.com/">demo server</a>.,
124
You can have a peek at it
125
without installing anything.</P>
126
<h2>Feedback Requested</h2>
127
<P>I would appreciate feedback on this paper. If you have additional ideas,
128
comments or find bugs, please
129
<a href="mailto:rgerhards@adiscon.com">let me know</a>.</P>
130
<h2>References and Additional Material</h2>
132
<li><a href="http://www.vermeer.org/projects/php-syslog-ng">php-syslog-ng</a></li>
134
<h2>Revision History</h2>
137
<a href="http://www.adiscon.com/en/people/rainer-gerhards.php">Rainer Gerhards</a> *
138
initial version created</li>
141
<p>Copyright (c) 2005
142
<a href="http://www.adiscon.com/en/people/rainer-gerhards.php">Rainer Gerhards</a>
143
and <a href="http://www.adiscon.com/en/">Adiscon</a>.</p>
144
<p>Permission is granted to copy, distribute and/or modify this document under
145
the terms of the GNU Free Documentation License, Version 1.2 or any later
146
version published by the Free Software Foundation; with no Invariant Sections,
147
no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be
148
viewed at <a href="http://www.gnu.org/copyleft/fdl.html">
149
http://www.gnu.org/copyleft/fdl.html</a>.</p>
b'\\ No newline at end of file'
added
removed
doc/rsyslog_php_syslog_ng.html
