rsyslog mysqL 不同的表_如何使用rsyslog输出到mysql数据库进行故障排除

使用FreeBSD 8.0 32位.

我用ommysql安装了rsyslogd 5.5.5. (已安装端口/usr/ports / sysutils / rsyslog55和/usr/ports / sysutils / rsyslog55-mysql)

我的rsyslog.conf文件如下所示：

$ModLoad imudp

$ModLoad imtcp

$ModLoad ommysql

$ModLoad immark.so

$ModLoad imuxsock.so

$ModLoad imklog.so

$OptimizeForUniprocessor on

$AllowedSender UDP, 10.0.0.0/8

$UDPServerAddress 0.0.0.0

$UDPServerRun 514

$UDPServerTimeRequery 2

#

+SG560

*.* :ommysql:127.0.0.1,Syslog,sysloguser,mypassword

我的rsyslogd命令行标志是：-c5 -4

使用-c5 -N1检查代码不会返回任何错误.

我已经确认rsyslogd正在通过更改最后一行来说：

*.* /var/log/snapgear.log

这会导致消息出现在snapgear.log文件中.所以它可能与我的MySQL设置有关

如果我做：

mysql -u sysloguser -p Syslog

Enter password:

Welcome to the MySQL monitor. Commands end with ; or \g.

Your MySQL connection id is 56

Server version: 5.0.86 FreeBSD port: mysql-server-5.0.86

mysql> select * from SystemEvents;

Empty set (0.00 sec)

mysql>

🙁

我已确认sysloguser具有Syslog数据库的完全权限.

如果我在调试模式下在控制台上运行rsyslogd：

/usr/local/sbin/rsyslogd -f /usr/local/etc/rsyslog.conf -c5 -n -d

每次收到消息时我都能看到这一系列事件：

9244.376687256:28359280: main Q: entry added, size now log 1, phys 1 entries

9244.376705694:28359280: main Q: EnqueueMsg advised worker start

9244.376726647:28359280: Listening on UDP syslogd socket 4 (IPv4/port 514).

9244.376728602:28359280: --------imUDP calling select, active file descriptors (max 4): 4

9244.376890075:283593c0: wti 0x28306e80: worker awoke from idle processing

9244.376892031:283593c0: we deleted 0 objects and enqueued 0 objects

9244.376893986:283593c0: delete batch from store, new sizes: log 1, phys 1

9244.376895942:283593c0: msgConsumer processes msg 0/1

9244.376897898:283593c0: msg parser: flags 70, from '~NOTRESOLVED~', msg 'Jun 29 17:32:24 SG560 kernel: (20000629T1732244'

9244.376900132:283593c0: parse using parser list 0x283080e8 (the default list).

9244.376902088:283593c0: dropped LF at very end of message (DropTrailingLF is set)

9244.376904044:283593c0: Parser 'rsyslog.rfc5424' returned -2160

9244.376905999:283593c0: Message will now be parsed by the legacy syslog parser (one size fits all... ;)).

9244.376907955:283593c0: Parser 'rsyslog.rfc3164' returned 0

9244.376909910:283593c0: testing filter, f_pmask 255

9244.376911866:283593c0: Called action, logging to ommysql

9244.376918012:283593c0: actionTryResume: action state: susp, next retry (if applicable): 1277869250 [now 1277869244]

9244.376919967:283593c0: action call returned -2123

9244.376921923:283593c0: tryDoAction: unexpected error code -2123, finalizing

9244.376926113:283593c0: actionTryResume: action state: susp, next retry (if applicable): 1277869250 [now 1277869244]

9244.376928069:283593c0: ruleset: get iRet 0 from rule.ProcessMsg()

9244.376930024:283593c0: ruleset.ProcessMsg() returns 0

9244.376931980:283593c0: regular consumer finished, iret=0, szlog 0 sz phys 1

9244.376933936:283593c0: XXX: enqueueing data element 0 of 1

9244.376935891:283593c0: we deleted 1 objects and enqueued 0 objects

9244.376938126:283593c0: delete batch from store, new sizes: log 0, phys 0

9244.376940082:283593c0: regular consumer finished, iret=4, szlog 0 sz phys 0

9244.376942037:283593c0: main Q:Reg/w0: worker IDLE, waiting for work.

….我可以看到对ommysql的Action调用返回意外的错误代码-2123

现在我被卡住了！关于下一步该寻找什么的任何想法？也许我需要安装额外的端口？我将非常感谢这里的任何帮助！