...
The values of these levels should be guided by the structure we propose because they will be saved in the events when saved in Devo. When you open the resulting data table, these will appear in the environment, application, and clon columns fields.
These are the valid tags and corresponding data tables that will receive the parsers' data:
...
/etc/rsyslog.d/45-mysql.conf file
| Code Block |
|---|
template(
name="mysql"
type="string"
string="<%PRI%>%timegenerated% %HOSTNAME% %syslogtag% %msg%"
)
# MySQL general log
input(
type="imfile"
File="/var/lib/mysql/mysql.log"
Tag="db.mysql.out.ENV.APP.CLON:"
Facility="user"
Severity="info"
PersistStateInterval="1"
reopenOnTruncate="on"
freshStartTail="on"
ruleset="mysql-rules"
)
# MySQL error log
input(
type="imfile"
File="/var/lib/mysql/mysql-error.log"
Tag="db.mysql.error.ENV.APP.CLON:"
Facility="user"
Severity="info"
PersistStateInterval="1"
reopenOnTruncate="on"
freshStartTail="on"
ruleset="mysql-rules"
)
# MySQL slow log
input(
type="imfile"
File="/var/lib/mysql/mysql-slow.log"
Tag="db.mysql.slow.ENV.APP.CLON:"
Facility="user"
Severity="info"
PersistStateInterval="1"
reopenOnTruncate="on"
freshStartTail="on"
ruleset="mysql-rules"
)
ruleset(name="mysql-rules") {
action(
type="omfwd"
template="mysql"
queue.type="LinkedList"
queue.filename="mysqlq1"
queue.saveonshutdown="on"
action.resumeRetryCount="-1"
Target="DEVO-RELAY"
Port="PORT"
Protocol="tcp"
)
}
# Send to Devo directly over TLS
#ruleset(name="mysql-rules") {
# action(
# type="omfwd"
# template="mysql"
# queue.type="LinkedList"
# queue.filename="mysqlq1"
# queue.saveonshutdown="on"
# action.resumeRetryCount="-1"
# Target="collector-us.devo.io"
# Port="443"
# Protocol="tcp"
# StreamDriver="gtls"
# StreamDriverMode="1"
# StreamDriverAuthMode="x509/name"
# StreamDriverPermittedPeers="collector-us.devo.io"
# )
#} |
Note the following placeholder values in the sample file above:
...
Make sure that the file you are sending and the directory where resides can be read by the user running rsyslog. If not, you can assign the necessary permissions by changing the file group to syslog:
| Code Block |
|---|
chown :syslog /var/log/mysql /var/log/mysql/*.log
chmod 750 /var/log/mysql
chmod 640 /var/log/mysql/*.log |
To configure file rotation, you can use the logrotate utility. The following in an example of a mysql.conf might be set up.
/etc/logrotate.d/mysql file
| Code Block |
|---|
/var/log/mysql/mysql.log /var/log/mysql/mysql-slow.log /var/log/mysql/error.log {
daily
rotate 7
missingok
create 640 mysql syslog
compress
sharedscripts
postrotate
test -x /usr/bin/mysqladmin || exit 0
MYADMIN="/usr/bin/mysqladmin --defaults-file=/etc/mysql/debian.cnf"
if [ -z "`$MYADMIN ping 2>/dev/null`" ]; then
if killall -q -s0 -umysql mysqld; then
exit 1
fi
else
$MYADMIN flush-logs
fi
endscript
} |
When you have made all the configuration changes necessary, don't forget to restart the rsyslog process:
...
/etc/rsyslog.d/46-mysql-local.conf
| Code Block |
|---|
$template mysql-local,"<%PRI%>%timegenerated% %HOSTNAME% db.mysql.error.ENV.APP.CLON:%msg%"
# SSL config for DEVO Cloud
#$DefaultNetstreamDriver gtls # use gtls netstream driver
#$DefaultNetstreamDriverCAFile /etc/rsyslog.d/certs/ca.crt
#$DefaultNetstreamDriverCertFile /etc/rsyslog.d/certs/user.crt
#$DefaultNetstreamDriverKeyFile /etc/rsyslog.d/certs/user.key
#$ActionSendStreamDriverMode 1 # require TLS for the connection
#$ActionSendStreamDriverAuthMode x509/name
#$ActionSendStreamDriverPermittedPeer collector
if $programname contains 'mysql' then @@DEVO-RELAY:PORT;mysql-local
:programname, contains, "mysql" ~ |
Table structure
These are the fields displayed in these tables:
...