Hi,
Thanks for the logs. They are working properly for me.
I suspect you are unable to replay them because you didn't set the template for the DEBUG.log as I stated in a previous post (the time stamps are missing).
Here's the correct template to use for both the db_insert and DEBUG.log.
destination d_logzilla {
program("/var/www/logzilla/scripts/db_insert.pl"
template("$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC\t$HOST\t$PRI\t$PROGRAM\t$MSGONLY\n")
template_escape(yes)
);
};
destination df_logzilla {
file("/var/log/logzilla/DEBUG.log"
template("$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC\t$HOST\t$PRI\t$PROGRAM\t$MSGONLY\n")
template_escape(yes)
);
};
# Tell syslog-ng to log to our new destination
log {
source(s_all);
destination(d_logzilla);
# Uncomment below and restart syslog-ng for debugging
destination(df_logzilla);
};
That said, here is a script you can use that will replay the events you gave me without a timestamp (they will be inserted with the current time).
(note that you may need additional perl modules to run it), which you can do by typing, for example, :
perl cpan Data::Random
# cat playlogs.pl
#!/usr/bin/perl
##
##
use strict;
$| = 1;
use POSIX qw/strftime/;
use Switch;
use vars qw/ %opt /;
use Data::Random qw(:all);
my ($input, $output, $sleep, $sleep_end);
sub init()
{
use Getopt::Std;
my $opt_string = 'i:o:ht:e:';
getopts( "$opt_string", \%opt ) or usage();
usage() if $opt{h};
$input = defined($opt{'i'}) ? $opt{'i'} : 'syslog.log';
$sleep = defined($opt{'t'}) ? $opt{'t'} : '1';
$sleep_end = $opt{'e'};
}
init();
#
# Help message
#
sub usage()
{
print STDERR << "EOF";
Used to replay lz formatted logs into db_insert with timestamps
-i : Specify input file from the sample_logs/ directory
-t : Sleep seconds between messages (default: 1)
-e : End sleep seconds (optional, will randomize between start (-t) and end (-e) seconds.
Sample Usage:
Show what would be replayed:
$0 -i sample_logs/*.log -t .5 -e 1.5 | more
Replay into LogZilla:
$0 -i sample_logs/*.log -t .5 -e 1.5 | /var/www/logzilla/scripts/db_insert.pl
Note that db_insert will not return status while running unless you set debug or verbose on it as well (-d1 -v)
EOF
exit;
}
my $regex = qr/\t?(\S+)\t(\d+)\t(\S+).*\t(.*)/;
my $count = 0;
my ($host, $sev, $fac, $pri, $msg, $mne, $prg, @arr);
open(INPUT, "<$input") || die("Try $0 -h\n");
while(<INPUT>) {
chomp;
$_ =~ s/\r\n$/\n/;
if ($_ =~ m/$regex/) {
$host = $1;
$pri = $2;
$prg = $3;
$msg = $4;
my $now = strftime("%Y-%m-%d %H:%M:%S", localtime);
my $dt = rand_datetime( min => '2011-9-1 4:0:0', max => 'now' );
print("$now\t$host\t$pri\t$prg\t$msg\n");
my $sleeptime;
if ($sleep_end) {
$sleeptime = ($sleep + rand($sleep_end));
} else {
$sleeptime = $sleep;
}
#print "Sleeping for $sleeptime\n";
select( undef, undef, undef, $sleeptime );
}
$host = "";
$prg = "";
$mne = "";
$msg = "";
$sev = "";
$count++;
}
