ommsql Can't Connect to mysql socket

[PilotST]

Guys, I hate to open this and find out it is [likely] a simple thing but I've been pulling my hair out trying to figure this out and it's just killing me. I'm sorry in advance for the person that looks at this and says "well, duh..." Any help anyone has would be more than appreciated.

I think I have everything installed correctly with my MariaDB:

● mariadb.service - MariaDB 10.11.11 database server
Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; preset: enabled)
Active: active (running) since Thu 2025-04-03 17:21:05 UTC; 8s ago
Docs: man:mariadbd(8)
https://mariadb.com/kb/en/library/systemd/
Process: 33109 ExecStartPre=/usr/bin/install -m 755 -o mysql -g root -d /var/run/mysqld (code=exited, status=0/SUCCESS)
Process: 33111 ExecStartPre=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)
Process: 33113 ExecStartPre=/bin/sh -c [ ! -e /usr/bin/galera_recovery ] && VAR= || VAR=/usr/bin/galera_recovery; [ $? -eq 0 ] && systemctl set-environment _WSREP_START_POSITION=$VAR || exit 1 (code=exited, status=0>
Process: 33189 ExecStartPost=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)
Process: 33191 ExecStartPost=/etc/mysql/debian-start (code=exited, status=0/SUCCESS)
Main PID: 33173 (mariadbd)
Status: "Taking your SQL requests now..."
Tasks: 15 (limit: 15423)
Memory: 118.0M (peak: 120.9M)
CPU: 496ms
CGroup: /system.slice/mariadb.service
└─33173 /usr/sbin/mariadbd

Apr 03 17:21:04 echelon.tmg.help mariadbd[33173]: 2025-04-03 17:21:04 0 [Note] Plugin 'FEEDBACK' is disabled.
Apr 03 17:21:04 echelon.tmg.help mariadbd[33173]: 2025-04-03 17:21:04 0 [Warning] You need to use --log-bin to make --expire-logs-days or --binlog-expire-logs-seconds work.
Apr 03 17:21:04 echelon.tmg.help mariadbd[33173]: 2025-04-03 17:21:04 0 [Note] Server socket created on IP: '127.0.0.1'.
Apr 03 17:21:04 echelon.tmg.help mariadbd[33173]: 2025-04-03 17:21:04 0 [Note] /usr/sbin/mariadbd: ready for connections.
Apr 03 17:21:04 echelon.tmg.help mariadbd[33173]: Version: '10.11.11-MariaDB-0ubuntu0.24.04.2' socket: '/var/run/mysqld/mysqld.sock' port: 3306 Ubuntu 24.04
Apr 03 17:21:05 echelon.tmg.help systemd[1]: Started mariadb.service - MariaDB 10.11.11 database server.
Apr 03 17:21:05 echelon.tmg.help /etc/mysql/debian-start[33194]: Upgrading MariaDB tables if necessary.
Apr 03 17:21:05 echelon.tmg.help /etc/mysql/debian-start[33209]: WARNING: mysql.user contains 1 root accounts without password!
Apr 03 17:21:05 echelon.tmg.help /etc/mysql/debian-start[33210]: Triggering myisam-recover for all MyISAM tables and aria-recover for all Aria tables
Apr 03 17:21:05 echelon.tmg.help mariadbd[33173]: 2025-04-03 17:21:05 0 [Note] InnoDB: Buffer pool(s) load completed at 250403 17:21:05

as well as rsyslog:

ubuntu@echelon:/etc$ sudo systmectl restart rsyslog
sudo: systmectl: command not found
ubuntu@echelon:/etc$ sudo systemctl restart rsyslog
ubuntu@echelon:/etc$ sudo systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; preset: enabled)
Active: active (running) since Thu 2025-04-03 17:21:37 UTC; 6s ago
TriggeredBy: ● syslog.socket
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Process: 33267 ExecStartPre=/usr/lib/rsyslog/reload-apparmor-profile (code=exited, status=0/SUCCESS)
Main PID: 33272 (rsyslogd)
Tasks: 10 (limit: 2336)
Memory: 2.9M (peak: 5.3M)
CPU: 213ms
CGroup: /system.slice/rsyslog.service
└─33272 /usr/sbin/rsyslogd -n -iNONE

Apr 03 17:21:37 echelon.tmg.help rsyslogd[33272]: action 'action-8-ommysql' suspended (module 'ommysql'), retry 11. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog>
Apr 03 17:21:37 echelon.tmg.help rsyslogd[33272]: action 'action-8-ommysql' suspended (module 'ommysql'), retry 12. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog>
Apr 03 17:21:37 echelon.tmg.help rsyslogd[33272]: action 'action-8-ommysql' suspended (module 'ommysql'), retry 13. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog>
Apr 03 17:21:37 echelon.tmg.help rsyslogd[33272]: action 'action-8-ommysql' suspended (module 'ommysql'), retry 14. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog>
Apr 03 17:21:37 echelon.tmg.help rsyslogd[33272]: action 'action-8-ommysql' suspended (module 'ommysql'), retry 15. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog>
Apr 03 17:21:37 echelon.tmg.help rsyslogd[33272]: action 'action-8-ommysql' suspended (module 'ommysql'), retry 16. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog>
Apr 03 17:21:37 echelon.tmg.help rsyslogd[33272]: action 'action-8-ommysql' suspended (module 'ommysql'), retry 17. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog>
Apr 03 17:21:37 echelon.tmg.help rsyslogd[33272]: action 'action-8-ommysql' suspended (module 'ommysql'), retry 18. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog>
Apr 03 17:21:37 echelon.tmg.help rsyslogd[33272]: action 'action-8-ommysql' suspended (module 'ommysql'), retry 19. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog>
Apr 03 17:21:37 echelon.tmg.help rsyslogd[33272]: action 'action-8-ommysql' suspended (module 'ommysql'), retry 20. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog>

But, as you can see, I keep getting this damn socket connection error. I've tried what I think is everything, but I can't get rsyslog to correctly load. As such, I get no data in the syslog plugin

2025-04-03T17:21:37.715259+00:00 echelon rsyslogd: rsyslogd's groupid changed to 102
2025-04-03T17:21:37.715280+00:00 echelon rsyslogd: rsyslogd's userid changed to 102
2025-04-03T17:21:37.715302+00:00 echelon rsyslogd: [origin software="rsyslogd" swVersion="8.2312.0" x-pid="33272" x-info="https://www.rsyslog.com"] start
2025-04-03T17:21:37.756833+00:00 echelon rsyslogd: ommysql: db error (2002): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (13) [v8.2312.0]
2025-04-03T17:21:37.757196+00:00 echelon rsyslogd[33272]: rsyslogd: ommysql: db error (2002): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (13) [v8.2312.0]
2025-04-03T17:21:37.757293+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.757312+00:00 echelon kernel: audit: type=1400 audit(1743700897.755:5683): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="rsyslogd" name="run/mysqld/mysqld.sock" pid=33272 comm=72733A6D61696E20513A526567 requested_mask="wr" denied_mask="wr" fsuid=102 ouid=113
2025-04-03T17:21:37.757315+00:00 echelon kernel: audit: type=1400 audit(1743700897.756:5684): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="rsyslogd" name="run/mysqld/mysqld.sock" pid=33272 comm=72733A6D61696E20513A526567 requested_mask="wr" denied_mask="wr" fsuid=102 ouid=113
2025-04-03T17:21:37.757390+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), next retry is Thu Apr 3 17:22:07 2025, retry nbr 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.757647+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 1. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.758916+00:00 echelon kernel: audit: type=1400 audit(1743700897.757:5685): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="rsyslogd" name="run/mysqld/mysqld.sock" pid=33272 comm=72733A6D61696E20513A526567 requested_mask="wr" denied_mask="wr" fsuid=102 ouid=113
2025-04-03T17:21:37.758920+00:00 echelon kernel: audit: type=1400 audit(1743700897.757:5686): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="rsyslogd" name="run/mysqld/mysqld.sock" pid=33272 comm=72733A6D61696E20513A526567 requested_mask="wr" denied_mask="wr" fsuid=102 ouid=113
2025-04-03T17:21:37.758924+00:00 echelon kernel: audit: type=1400 audit(1743700897.757:5687): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="rsyslogd" name="run/mysqld/mysqld.sock" pid=33272 comm=72733A6D61696E20513A526567 requested_mask="wr" denied_mask="wr" fsuid=102 ouid=113
2025-04-03T17:21:37.758925+00:00 echelon kernel: audit: type=1400 audit(1743700897.758:5688): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="rsyslogd" name="run/mysqld/mysqld.sock" pid=33272 comm=72733A6D61696E20513A526567 requested_mask="wr" denied_mask="wr" fsuid=102 ouid=113
2025-04-03T17:21:37.758925+00:00 echelon kernel: audit: type=1400 audit(1743700897.758:5689): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="rsyslogd" name="run/mysqld/mysqld.sock" pid=33272 comm=72733A6D61696E20513A526567 requested_mask="wr" denied_mask="wr" fsuid=102 ouid=113
2025-04-03T17:21:37.759127+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 2. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.759191+00:00 echelon kernel: audit: type=1400 audit(1743700897.758:5690): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="rsyslogd" name="run/mysqld/mysqld.sock" pid=33272 comm=72733A6D61696E20513A526567 requested_mask="wr" denied_mask="wr" fsuid=102 ouid=113
2025-04-03T17:21:37.759206+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 3. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.759672+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 4. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.759888+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 5. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.760191+00:00 echelon kernel: audit: type=1400 audit(1743700897.759:5691): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="rsyslogd" name="run/mysqld/mysqld.sock" pid=33272 comm=72733A6D61696E20513A526567 requested_mask="wr" denied_mask="wr" fsuid=102 ouid=113
2025-04-03T17:21:37.760484+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 6. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.760702+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 7. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.761048+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 8. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.761559+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 9. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.762580+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 10. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.763229+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 11. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]
2025-04-03T17:21:37.763741+00:00 echelon rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 12. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ]

[PilotST]

Update:
My rsyslogd version:
rsyslogd 8.2312.0 (aka 2023.12) compiled with:

My /etc/rsyslog.d/cacti.conf file:

Version Below 2.0 <-- ;template expected error

$ModLoad ommysql
#$ActionOmmysqlServerPort 3306

$template cacti_syslog,"INSERT INTO SystemEvents(facility_id, priority_id, program, logtime, host, message) values (%syslogfacility%, %syslogpriority%, '%programname%', '%timegenerated:::date-mysql%', '%HOSTNAME%', TRIM('%msg>

. >localhost,my_database,my_user,my_pass;cacti_syslog <--- This will generate this error "invalid character in selector line - ';template' expected"

. >localhost,my_database,my_user,my_pass;cacti_syslog <--- This will give me this error: Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (13) [v8.2312.0]

Version Above 2.4 <--- This doesn't work at all, lots of errors

#module(load="ommysql")
#action(type="ommysql" server="localhost" serverport="3306" db="my_database" uid="my_user" pwd="my_password")

#$template cacti_syslog,"INSERT INTO SystemEvents(facility_id, priority_id, program, logtime, host, message) values (%syslogfacility%, %syslogpriority%, '%programname%', '%timegenerated:::date-mysql%', '%HOSTNAME%', TRIM('%ms>

[xmacan]

#$template cacti_syslog,"INSERT INTO SystemEvents(facility_id, priority_id, program, logtime, host, message) values (%syslogfacility%, %syslogpriority%, '%programname%', '%timegenerated:::date-mysql%', '%HOSTNAME%', TRIM('%ms

Isn't it a problem that you have this line commented out?

[PilotST]

It isn't. The posted snippet is the entire file, the first section is the one that... kinda works. That template string isn't commented out.

[TheWitness]

Can you state the rsyslog version and then maybe create a pull request?

[PilotST]

Dealing with a client’s major problems at the moment but I think I’m going to change the setup a bit and just setup a separate syslog server anyway. I’ll report back if I still have issues once I get that done. Hopefully before I retire ;)

…

On Apr 6, 2025, at 5:36 PM, TheWitness ***@***.***> wrote: TheWitness left a comment (Cacti/plugin_syslog#236) Can you state the rsyslog version and then maybe create a pull request? — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread. <#236 (comment)> <https://github.com/notifications/unsubscribe-auth/BRERSBVXKOQ45E76MXQXKIT2YHB7LAVCNFSM6AAAAAB2MZSDROVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDOOBRG43DMMZYGA> TheWitness left a comment (Cacti/plugin_syslog#236) <#236 (comment)> Can you state the rsyslog version and then maybe create a pull request? — Reply to this email directly, view it on GitHub <#236 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BRERSBVXKOQ45E76MXQXKIT2YHB7LAVCNFSM6AAAAAB2MZSDROVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDOOBRG43DMMZYGA>. You are receiving this because you authored the thread.

[TheWitness]

Hehe, don't I know that feeling. I was discussing changing the partitioning algorithm with @xmacan yesterday and introducing parallel queries as well.

So, it's likely some big things are coming to syslog though it might take a while. Talking with the folks at MariaDB first as MySQL is now supporting partitions by the hour using a timestamp and MariaDB appears to not have made that enhancement yet.

[PilotST]

Alrighty Larry, et. Al. back at this…. Two weeks and many less lives later…. I’ve looked everywhere for an answer and nothing was all that helpful… If you have any experience with this, I’m all ears. /etc/rsyslog.d/cacti.conf File module(load="ommysql") action(type="ommysql" server="localhost" serverport="3306" db="syslog" uid="cactiuser" pwd=“cactipassword") $template cacti_syslog,"INSERT INTO syslog_incoming(facility_id, priority_id, program, logtime, host, message) values(%syslogfacility%, %syslogpriority%, '%programname%', '%timegenerated:::date-mysql%', '%HOSTNAME%', TRIM('%m> Fresh installs of both MariaDB and rsyslog: ***@***.***:~$ rsyslogd -v rsyslogd 8.2312.0 (aka 2023.12) compiled with: PLATFORM: x86_64-pc-linux-gnu PLATFORM (lsb_release -d): FEATURE_REGEXP: Yes GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes memory allocator: system default Runtime Instrumentation (slow code): No uuid support: Yes systemd support: Yes Config file: /etc/rsyslog.conf PID file: /run/rsyslogd.pid Number of Bits in RainerScript integers: 64 See https://www.rsyslog.com for more information. And the results once I start it. I’ve bold the first error 2025-04-23T00:52:00.505494+00:00 hydra systemd[1]: Stopping rsyslog.service - System Logging Service... 2025-04-23T00:52:00.508255+00:00 hydra rsyslogd: [origin software="rsyslogd" swVersion="8.2312.0" x-pid="3658" x-info="https://www.rsyslog.com"] exiting on signal 15. 2025-04-23T00:52:00.510954+00:00 hydra systemd[1]: rsyslog.service: Deactivated successfully. 2025-04-23T00:52:00.511004+00:00 hydra systemd[1]: Stopped rsyslog.service - System Logging Service. 2025-04-23T00:52:00.515375+00:00 hydra systemd[1]: Starting rsyslog.service - System Logging Service... 2025-04-23T00:52:00.653974+00:00 hydra systemd[1]: Started rsyslog.service - System Logging Service. 2025-04-23T00:52:00.656547+00:00 hydra rsyslogd: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2312.0] 2025-04-23T00:52:00.657184+00:00 hydra rsyslogd: rsyslogd's groupid changed to 102 2025-04-23T00:52:00.657221+00:00 hydra rsyslogd: rsyslogd's userid changed to 102 2025-04-23T00:52:00.657245+00:00 hydra rsyslogd: [origin software="rsyslogd" swVersion="8.2312.0" x-pid="3713" x-info="https://www.rsyslog.com"] start 2025-04-23T00:52:00.653497+00:00 hydra kernel: audit: type=1400 audit(1745369520.609:266): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="rsyslogd" pid=3711 comm="apparmor_parser" 2025-04-23T00:52:00.659042+00:00 hydra rsyslogd: ommysql: db error (2002): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (13) [v8.2312.0] 2025-04-23T00:52:00.659087+00:00 hydra rsyslogd[3713]: rsyslogd: ommysql: db error (2002): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (13) [v8.2312.0] 2025-04-23T00:52:00.659115+00:00 hydra rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2025-04-23T00:52:00.659139+00:00 hydra rsyslogd: action 'action-8-ommysql' suspended (module 'ommysql'), next retry is Wed Apr 23 00:52:30 2025, retry nbr 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] The MariaDB version ***@***.***:~$ sudo systemctl status mariadb ● mariadb.service - MariaDB 10.11.11 database server Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; preset: enabled) Active: active (running) since Tue 2025-04-22 23:59:22 UTC; 56min ago Docs: man:mariadbd(8) https://mariadb.com/kb/en/library/systemd/ Process: 1223 ExecStartPre=/usr/bin/install -m 755 -o mysql -g root -d /var/run/mysqld (code=exited, status=0/SUCCESS) Process: 1225 ExecStartPre=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS) Process: 1227 ExecStartPre=/bin/sh -c [ ! -e /usr/bin/galera_recovery ] && VAR= || VAR=`/usr/bin/galera_recovery`; [ $? -eq 0 ] && systemctl set-environment _WSREP_START_POSITION=$VAR || exit 1 (code=exited, status=0/> Process: 1329 ExecStartPost=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS) Process: 1331 ExecStartPost=/etc/mysql/debian-start (code=exited, status=0/SUCCESS) Main PID: 1317 (mariadbd) Status: "Taking your SQL requests now..." Tasks: 9 (limit: 7451) Memory: 78.9M (peak: 81.8M) CPU: 599ms CGroup: /system.slice/mariadb.service └─1317 /usr/sbin/mariadbd And the socket running ***@***.***:~$ netstat -ln | grep mysql unix 2 [ ACC ] STREAM LISTENING 9749 /var/run/mysqld/mysqld.sock

…

On Apr 8, 2025, at 5:54 AM, TheWitness ***@***.***> wrote: TheWitness left a comment (Cacti/plugin_syslog#236) Hehe, don't I know that feeling. I was discussing changing the partitioning algorithm with @xmacan yesterday and introducing parallel queries as well. So, it's likely some big things are coming to syslog though it might take a while. Talking with the folks at MariaDB first as MySQL is now supporting partitions by the hour using a timestamp and MariaDB appears to not have made that enhancement yet. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread. <https://github.com/xmacan> <#236 (comment)> <https://github.com/notifications/unsubscribe-auth/BRERSBW3EPYV4H47XQDWIML2YPBIBAVCNFSM6AAAAAB2MZSDROVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDOOBWGM2DIMBVGE> TheWitness left a comment (Cacti/plugin_syslog#236) <#236 (comment)> Hehe, don't I know that feeling. I was discussing changing the partitioning algorithm with @xmacan <https://github.com/xmacan> yesterday and introducing parallel queries as well. So, it's likely some big things are coming to syslog though it might take a while. Talking with the folks at MariaDB first as MySQL is now supporting partitions by the hour using a timestamp and MariaDB appears to not have made that enhancement yet. — Reply to this email directly, view it on GitHub <#236 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BRERSBW3EPYV4H47XQDWIML2YPBIBAVCNFSM6AAAAAB2MZSDROVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDOOBWGM2DIMBVGE>. You are receiving this because you authored the thread.

[arno-st]

Try this config for cacti.conf (it's the one I have and working), the if can be removed, i have it only for filter some log.

module(load="imudp") # needs to be done just once
input(type="imudp" port="5544")

module(load="ommysql")

$template cacti_syslog,"INSERT INTO syslog_incoming(facility_id, priority_id, program, logtime, host, message) \
  values (%syslogfacility%, %syslogpriority%, '%programname%', '%timegenerated:::date-mysql%', '%HOSTNAME%', TRIM('%msg%'))", SQL

if $syslogfacility-text == 'local6' then {
        action(type="ommysql" server="127.0.0.1" serverport="7033" db="syslog_prod" uid="syslog_user" pwd="syslog_pas" Template="cacti_syslog" )
        *.* stop
}

[arno-st]

Ho the imudp with port 5544 is to have only syslog from my equipement, not from Cacti or other server.

[TheWitness]

You may have to use the real IP address of the server and change the permissions to allow other than localhost to access. This is less about Cacti and more about rsyslog. Often times 127.0.0.1 implies the MySQL/MariaDB socket. You are also defining a serverport? Is that correct? If you are using a serverport, does that no imply using something other than a socket?

If this is new, I would see first what changed. Otherwise, I would use the IP Address and port, and adjust your Database Grants accordingly.