Description of problem:
I have installed a central rsyslog-Server that log all traffic in a mysql-DB. This we have run since years, but
today we have configure one new client to send the log to this central log-server.
I have seen a lot of errors:
14:10:24 logserver rsyslogd: db error (1054): Unknown column 'invld' in 'field list'
When I activate on mysql the LOG SQL-Statemant i see the problem:
Statemant with error:
insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values (' lsass: [lsass] Refresh TGT succeeded', invld, '10.240.175.11', 7, '20161230174334', '20161230174334', 1, 'isinas-2(id2)')
The problem is the field Facility (ONLY NUM!) and the client send invld.
insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values (' Accepted publickey for oan from 10.240.2.1 port 61171 ssh2', 10, 'servera', 6, '20161230175618', '20161230175618', 1, 'sshd:')
After a lot of FAILURE DB rsyslog don't try insert logs into DB and log only to the filesystem (Workdirectory).
Version-Release number of selected component (if applicable):
Steps to Reproduce:
Lot of mysql insert error messages
No error messages should be reported
How did you induced said DB errors? (What log command/source should I use to see them). Could not reproduce with log sources I tried (logger command, logs from systemd, sudo, systemctl ...)
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.