Upgrading the sql() source of syslog-ng PE
This section describes how you can upgrade your sql() source between syslog-ng Premium Edition (syslog-ng PE) 6 LTS and syslog-ng PE 7 LTS.
For more information about the mssql(), oracle(), or sql() sources, see mssql, oracle, sql: collecting messages from an SQL database.
To upgrade the sql() source between syslog-ng PE 6 LTS and syslog-ng PE 7 LTS
-
Extract the value of last_read_uid from the persist file by using persist tool.
For more information on using the persist tool, see the The syslog-ng manual pages.
- Add the extracted last_read_uid value to the syslog-ng PE configuration in a start-uid(value) format.
Example: adding the value of last_read_uid from the persist file into the configuration as start-uid(value)
You can add the value of last_read_uid that you extracted from the persist file into your configuration as start-uid(value)with the following method:
$ /opt/syslog-ng/bin/persist-tool dump /opt/syslog-ng/var/syslog-ng.persist
hostid = { "value": "65 D5 E1 06" }
freetds,mssql-host,1433,test_database,test_table = { "version": 0, "big_endian": false, "last_read_id": "2" }
run_id = { "value": "01 00 00 00" }
In the example above, the value is "2". The parameter in the configuration should look like start-uid("2").
Differences in configuration
This section describes the sql() source-related differences in configuration between syslog-ng PE 6 LTS and syslog-ng PE 7 LTS, including the features not ported from syslog-ng PE 6 LTS and the features that changed in usage since syslog-ng PE 6 LTS.
For more information about the mssql(), oracle(), or sql() sources, see mssql, oracle, sql: collecting messages from an SQL database.
Features not ported
- Only MSSQL and Oracle are supported in syslog-ng PE 7 LTS. MySQL and PostGreSQL users cannot upgrade to syslog-ng PE 7 LTS.
- archive-query(): It needs to be removed from configuration, because it is not supported in syslog-ng PE 7 LTS. Users need to find another way to cleanup old records.
- read-old-records(): This option is not supported in 7 LTS, as its functionality has been replaced by the start-uid() option. If you follow To upgrade the sql() source between syslog-ng PE 6 LTS and syslog-ng PE 7 LTS, your configuration will have a start-uid() in the appropriate configuration level and no specific action will be necessary.
Changes in features
-
default-facility()
The default value is user instead of local0.
To achieve original behavior, you have to set default-facility(local0) explicitly in your configuration.
-
default-priority()
The default value is notice instead of info.
In syslog-ng PE 7 LTS, default-priority has been renamed to default-severity(). For compatibility reasons, the original default-priority() option can be still used. However, One Identity recommends replacing it with default-severity() instead.
To achieve original behavior, you have to set default-severity(info) explicitly in your configuration.
-
follow-freq()
The default value of follow-freq() has changed to 60 seconds (1 minute). The original default value was 10 seconds in syslog-ng PE 6 LTS.
In syslog-ng PE 7 LTS, if time-reopen() is set, then syslog-ng PE will use the value you set. If neither time-reopen(), nor follow-freq() is set, the default value is 60 seconds.
To achieve original behavior, you have to set follow-freq(10) explicitly in your configuration.
-
host-template()
In syslog-ng PE 6 LTS, it was mandatory to set keep-hostname(yes) for host-template() to work. In syslog-ng PE 7 LTS, syslog-ng PE will automatically set keep-hostname(yes) even if you do not set it in your configuration. If you set host-template(), but also set keep-hostname(no), syslog-ng PE warns you about it, but otherwise ignores the keep-hostname() setting.
In 6 LTS, syslog-ng PE allowed empty host-template() options in configuration. In syslog-ng PE 7 LTS, the template is mandatory in host-template(template). The syslog-ng PE application will not start with such configuration. As a result, you have to delete empty host-template() options from your configuration.
-
message-template()
In 6 LTS, syslog-ng PE allowed empty message-template() options in configuration. In syslog-ng PE 7 LTS, the template is mandatory in message-template(template). The syslog-ng PE application will not start with such configuration. As a result, you have to delete empty message-template() options from your configuration.
-
program-template()
In syslog-ng PE6 LTS, allowed empty program-template() options in configuration. In syslog-ng PE 7 LTS, the template is mandatory in program-template(template). The syslog-ng PE application will not start with such configuration. As a result, you have to delete empty program-template() options from your configuration.
-
prefix()
You have to add a trailing dot to the prefix(). For example, if prefix(".sql") was provided in the configuration, the same option should look like prefix(".sql.") in syslog-ng PE 7 LTS.
If the prefix does not end with a trailing dot, syslog-ng PE 7 LTS will add it automatically, and emit a warning about it.
The default value has been changed to .sql. to reflect this change.
-
read-old-records()
-
read-old-records(yes) works the same way as in syslog-ng PE 6 LTS.
-
read-old-records(no): In syslog-ng PE 6 LTS, whenever syslog-ng PE starts, the application will only read those entries that are created after start. This means between restarts or reload, message loss is possible. In 7 LTS, syslog-ng PE will store the id of the message that was fetched last time in the persist file, even in case of read-old-records(no). When syslog-ng PE starts, it will continue from that id. This means that read-old-records() only takes effect when syslog-ng PE first starts. After restarts or reloads, read-old-records() is ignored.
Uninstalling syslog-ng PE
If you need to uninstall syslog-ng PE for some reason, you have the following options:
-
If you have installed syslog-ng PE from a .deb package: Execute the dpkg -r syslog-ng-premium-edition command to remove syslog-ng, or the dpkg -P syslog-ng-premium-edition command to remove syslog-ng PE and the configuration files as well. Note that removing syslog-ng PE does not restore the syslog daemon used before syslog-ng.
-
If you have installed syslog-ng PE from an .rpm package: Execute the rpm -e syslog-ng-premium-edition command to remove syslog-ng PE. Note that removing syslog-ng PE does not restore the syslog daemon used before syslog-ng PE.
-
If you have installed syslog-ng PE from a .pkg package: Execute the pkgrm BBsyslng command to remove syslog-ng PE. Note that removing syslog-ng PE does not restore the syslog daemon used before syslog-ng.
For automatic uninstall (answering y to all questions): Execute the yes | pkgrm BBsyslng command.
The following files have to be deleted manually:
-
<syslog-ng path>/etc/syslog-ng.conf
-
<syslog-ng path>/var/syslog-ng.persist
-
<syslog-ng path>/var/syslog-ng-00000.qf
-
anything else under the <syslog-ng path>/var directory
-
If you have installed syslog-ng PE using the .run installer: Execute the uninstall.sh script located at /opt/syslog-ng/bin/uninstall.sh. The uninstall script will automatically restore the syslog daemon used before installing syslog-ng. To completely remove syslog-ng PE, including the configuration files, use the uninstall.sh --purge command.
Configuring Microsoft SQL Server to accept logs from syslog-ng
The following describes how to configure your Microsoft SQL Server to enable remote logins and accept log messages from syslog-ng.
To configure your Microsoft SQL Server to enable remote logins and accept log messages from syslog-ng
-
Start the SQL Server Management Studio application. Select Start > Programs > Microsoft SQL Server 2005 > SQL Server Management Studio.
-
Create a new database.
-
Figure 20: Creating a new MSSQL database 1.
In the Object Explorer, right-click on the Databases entry and select New Database.
-
Figure 21: Creating a new MSSQL database 2.
Enter the name of the new database (for example, syslogng) into the Database name field and click OK.
-
Create a new database user and associate it with the new database.
-
Figure 22: Creating a new MSSQL user 1.
In the Object Explorer, select Security, right-click on the Logins entry, then select New Login.
-
Figure 23: Creating a new MSSQL user 2.
Enter a name (for example, syslog-ng) for the user into the Login name field.
-
Select the SQL Server Authentication option and enter a password for the user.
-
In the Default database field, select the database created in Step 2 (for example, syslogng).
-
In the Default language field, select the language of log messages that you want to store in the database, then click OK.
|
|
Caution:
Incorrect language settings may result in the database converting the messages to a different character-encoding format. That way the log messages may become unreadable, causing information loss. |
-
In the Object Explorer, select Security > Logins, then right-click on the new login created in the previous step, and select Properties.
-
Figure 24: Associating database with the new user
Select User Mapping. In the Users mapped to this login option, check the line corresponding to the new login (for example, syslogng). In the Database role membership field, check the db_owner and public options.
-
Figure 25: Associating database with the new user
Enable remote logins for SQL users.
In the Object Explorer right-click on your database server, and select Properties > Security, and set the Server Authentication option to SQL Server and Windows Authentication mode.
