Bug 1412395 - rsyslogd: db error (1054): Unknown column 'invld' in 'field list'
Summary: rsyslogd: db error (1054): Unknown column 'invld' in 'field list'
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: rsyslog
Version: 7.3
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Jiří Vymazal
QA Contact: Dalibor Pospíšil
URL:
Whiteboard:
Depends On: rsyslog-rhel74-rebase
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-01-11 23:30 UTC by SHAURYA
Modified: 2020-06-11 13:30 UTC (History)
5 users (show)

Fixed In Version: rsyslog-8.24.0-6.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-01 09:56:22 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1313490 0 medium CLOSED rebase to rsyslog v8 2021-03-11 14:30:26 UTC
Red Hat Product Errata RHBA-2017:2306 0 normal SHIPPED_LIVE rsyslog bug fix and enhancement update 2017-08-01 12:41:59 UTC

Internal Links: 1313490

Description SHAURYA 2017-01-11 23:30:31 UTC
Description of problem:

I have installed a central rsyslog-Server that log all traffic in a mysql-DB. This we have run since years, but 
today we have configure one new client to send the log to this central log-server. 
*.* :ommysql:127.0.0.1,Syslog,rsyslogdbadmin,PasswordHere

I have seen a lot of errors:
14:10:24 logserver rsyslogd: db error (1054): Unknown column 'invld' in 'field list'

When I activate on mysql the LOG SQL-Statemant i see the problem:
Statemant with error:
insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values  (' lsass[6212]: [lsass] Refresh TGT succeeded', invld, '10.240.175.11', 7, '20161230174334', '20161230174334', 1, 'isinas-2(id2)')
The problem is the field Facility (ONLY NUM!) and the client send invld.
Normal statement:
insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values (' Accepted publickey for oan from 10.240.2.1 port 61171 ssh2', 10, 'servera', 6, '20161230175618', '20161230175618', 1, 'sshd[54610]:')

After a lot of FAILURE DB rsyslog don't try insert logs into DB and log only to the filesystem (Workdirectory).

Version-Release number of selected component (if applicable):

rsyslog-7.4.7-16.el7.x86_64 

How reproducible:

Always

Steps to Reproduce:

http://www.systeen.com/2016/05/08/install-rsyslog-v8-loganalyzer-v4-centos-7/
or
http://tecadmin.net/setup-rsyslog-with-mysql-and-loganalyzer/

Actual results:

Lot of mysql insert error messages

Expected results:

No error messages should be reported

Additional info:

Comment 2 Jiří Vymazal 2017-01-23 13:21:21 UTC
How did you induced said DB errors? (What log command/source should I use to see them). Could not reproduce with log sources I tried (logger command, logs from systemd, sudo, systemctl ...)

Comment 23 errata-xmlrpc 2017-08-01 09:56:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2306


Note You need to log in before you can comment on or make changes to this bug.