On 05/03/14 14:38, Florian Ernst wrote:
> On Wed, Mar 05, 2014 at 12:13:23PM +0100, Michael Biebl wrote:
>> Am 05.03.2014 11:26, schrieb Michael Biebl:
>>> Am 05.03.2014 11:07, schrieb Daniel Pocock:
>>>> On 05/03/14 09:09, Florian Ernst wrote:
>>>>> On Tue, Mar 04, 2014 at 03:49:25PM +0100, Daniel Pocock wrote:
>>>>>> The rsyslog mongodb output module and the PHP mongodb modules are now in
>>>>>> wheezy-backports. This would appear to be sufficient to do something
>>>>>> like:
>>>>>>
>>>>>> rsyslog => mongodb => loganalyzer
>>>>>>
>>>>>> Has anybody else tried that or does anybody have any comments on it (or
>>>>>> recommended alternatives)?
>>>>> That actually did work for a time, but something broke starting with
>>>>> rsyslog 7.4.0-1. Since then the format of the data dumped into mongodb
>>>>> doesn't match what tools like loganalyzer expect, cf. #721277 / #728827.
>>>>> As I was merely experimenting with it I didn't follow up any further.
>>>> Some of this looks like documentation bugs and/or problems with the
>>>> default config rather than mongodb integration itself
>> Florian, have you followed the steps outlined in
>> http://www.rsyslog.com/tag/ommongodb/ ?
> ITIYM http://www.rsyslog.com/using-mongodb-with-rsyslog-and-loganalyzer/
> in particular?
>
> Not until now. Previously I followed
> http://www.rsyslog.com/doc/rsyslog_conf_modules.html/ommongodb.html
> (which now redirects to http://www.rsyslog.com/doc/ommongodb.html).
>
> I have now tried to implement the configuration mentioned there
> verbatim. This led to remote logs simply disappearing, i.e. not being
> logged on my syslog host. Thus I have reverted the change, for my
> current mongodb rsyslog configuration please see the other mail to
> Daniel.
Just out of interest, if you empty the database (or clear out the events
created before rsyslog 7.4 was installed) does LogAnalyzer work?
I'm not familiar with all the details of LogAnalyzer or the schema
attributes, this is just something that occurred to me when reading your
description of the problem
Also, I've just created a proper package of LogAnalyzer, it is in the
FTP queue - I'd appreciate any feedback you have about it or assistance
with maintaining it through our pkg-monitoring group. README.Debian has
some basic hints to get started with MongoDB, but if you could validate
or elaborate on it that would be very helpful.
While waiting for the package to be approved, you can build from git:
ssh://${USER}@git.debian.org/git/pkg-monitoring/loganalyzer.git
Vcs-Git: git://git.debian.org/pkg-monitoring/loganalyzer.git
Vcs-Browser:
http://git.debian.org/?p=pkg-monitoring/loganalyzer.git;a=summary
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
