月度存档: 四月 2014

loganalyzer3.6.5的一个bug

从昨天开始搞loganalyzer,一直无法显示自己mysql中的日志。

日志表是自定义的。

+---------+---------------------+------+-----+-------------------+----------------+
| Field   | Type                | Null | Key | Default           | Extra          |
+---------+---------------------+------+-----+-------------------+----------------+
| logId   | bigint(20) unsigned | NO   | PRI | NULL              | auto_increment | 
| account | char(64)            | NO   |     |                   |                | 
| server  | int(10) unsigned    | NO   |     | 0                 |                | 
| device  | char(64)            | NO   |     |                   |                | 
| error   | blob                | YES  |     | NULL              |                | 
| uID     | int(11)             | YES  |     | 0                 |                | 
| date    | timestamp           | NO   |     | CURRENT_TIMESTAMP |                | 
+---------+---------------------+------+-----+-------------------+----------------+

自己定义datasource,field,view,dbmapping,一切都OK。但就是显示有问题。

如下图所示少了uID那一列的数据。

google了N多资料都无解。

网上也有一个相同现象的帖子,也没有找到原因:http://kb.monitorware.com/reading-custom-mysql-table-t11919.html

一气之外感觉自己debug可能能找到原因。

在classes/logstreamdb.class.php 中

修改readnext方法如下:

 if ( $content['MaxExecutionTime'] > 0 && $scriptruntime > ($content['MaxExecutionTime']-2) )
                        {
                                // This may display a warning message, so the user knows we stopped reading records because of the script timeout.
                                $content['logstream_warning'] = "false";

                                // Run optional Message Parsers now
                                if ( isset($arrProperitesOut[SYSLOG_MESSAGE]) )
                                {
                                        $retParser = $this->_logStreamConfigObj->ProcessMsgParsers($arrProperitesOut[SYSLOG_MESSAGE], $arrProperitesOut);

                                        // Check if we have to skip the message!
                                        if ( $retParser == ERROR_MSG_SKIPMESSAGE )
                                                $ret = $retParser;
                                }

                                // Set uID to the PropertiesOut! //DEBUG -> $this->_currentRecordNum;
                                echo "<br/>";
                                echo $dbmapping[$szTableType];
                                foreach($dbmapping[$szTableType] as $key => $val) {
                                   echo "|".$key."|".$val, '<br>';
                                }
                                foreach($dbmapping[$szTableType]['DBMAPPINGS'] as $key => $val) {
                                   echo "|_|".$key."|".$val, '<br>';
                                }

                                foreach($this->bufferedRecords[$this->_currentRecordNum] as $key => $val) {
                                   echo "|||".$key."|".$val,"<br/>";
                                }

                                echo "SYSLOG_UID:".SYSLOG_UID."<br/>";
                                echo "hello ". $dbmapping[$szTableType]['DBMAPPINGS']['uID']."world";
                                echo "hello ". $this->bufferedRecords[$this->_currentRecordNum]['uid']."world";
                                echo "<br/>";
                                $uID = $arrProperitesOut[SYSLOG_UID] = $this->bufferedRecords[$this->_currentRecordNum][$dbmapping[$szTableType]['DBMAPPINGS'][SYSLOG_UID]];

                                // Increment $_currentRecordNum
                                $this->_currentRecordNum++;
                        }

把debug信息输出后,才发现问题。

uID对应数据中的logId字段,但在this->bufferedRecords中的key全是小写的。你妹的,各个文档上谁也没写要注意这么一个东西。dbmapping直接修改uID改为logid小写后,日志查看bug解决了。

正常的显示:

 

 

syslog接收客户端发送的日志

仅仅是这一个简单的功能,不想再重新再用java重新做。

直接用nginx+php往syslog中写,syslog往mysql中输出,使用log查看工具查看日志。

php中打开syslog输出:

1、编辑php.ini

取消下面一行的注释

error_log = syslog

2、重启nginx+php

3、写php测试一下:

<?php
        openlog('php', LOG_CONS | LOG_NDELAY | LOG_PID, LOG_USER | LOG_PERROR);
        syslog(LOG_INFO, 'hello php');
?>

4、在/var/log/message中可以看到输出:

php[21641]:  hello php
php[21642]:  hello php
php[21643]:  hello php

rsyslog接收日志写入mysql配置

$EscapeControlCharactersOnReceive off

$template TraditionalFormat2,"%msg%\n"
$template TraditionalFormat3,"%syslogtag% %msg%\n"
$template TraditionalFormat4,"%syslogtag% %msg%\n"
$template StdSQLFormat,"insert into bi_action(id,serverId,`date`,`%msg:R,ERE,1,DFLT:\w+ \w+ (\w+)--end%`) values(%msg:R,ERE,1,DFLT:(\w+)--end%,%msg:R,ERE,1,DFLT:\w+ (\w+) \w+--end%,%$year%%$month%%$day%,1) on duplicate key update `%msg:R,ERE,1,DFLT:\w+ \w+ (\w+)--end%`=`%msg:R,ERE,1,DFLT:\w+ \w+ (\w+)--end%`+1  ",SQL



        if re_match($syslogtag,'^moon[0-9]+-[a-zA-Z_]+.log$') then {
                $ActionFileDefaultTemplate TraditionalFormat2
                $template DynFile2,"/opt/logs/router-log/%syslogtag:R,ERE,1,DFLT:(.*)-.*.log--end%/%timegenerated:1:10:date-rfc3339%/%syslogtag:R,ERE,1,DFLT:.*-(.*).log--end%.log"
                *.* -?DynFile2
                $ModLoad ommysql
                *.* :ommysql:127.0.0.1,Syslog,root,
                stop
        } else if re_match($syslogtag,'^moon[0-9]+$') then {
                        $ActionFileDefaultTemplate TraditionalFormat3
                        $template DynFile3,"/opt/logs/router-log/moon-alert.log"
                        *.* -?DynFile3
                        stop
        } else if re_match($syslogtag,'^moon[0-9]+\\-BI$') then {
                        $ActionFileDefaultTemplate TraditionalFormat4
                        $template DynFile4,"/opt/logs/router-log/moon-BI.log"
                        *.* -?DynFile4
                        *.*     >127.0.0.1,Syslog,root,;StdSQLFormat

                        stop
        }

java visualvm jstatd启动时遇到的一个错误

今天启动jstatd时一直报下面的错误:

root@cvs jstatd]# jstatd -J-Djava.security.policy=/opt/joycube/jstatd/tools.policy
Could not contact registry
Connection refused to host: 192.168.17.12; nested exception is:
        java.net.ConnectException: Connection timed out
java.rmi.ConnectException: Connection refused to host: 192.168.17.12; nested exception is:
        java.net.ConnectException: Connection timed out
        at sun.rmi.transport.tcp.TCPEndpoint.newSocket(TCPEndpoint.java:619)
        at sun.rmi.transport.tcp.TCPChannel.createConnection(TCPChannel.java:216)
        at sun.rmi.transport.tcp.TCPChannel.newConnection(TCPChannel.java:202)
        at sun.rmi.server.UnicastRef.newCall(UnicastRef.java:341)
        at sun.rmi.registry.RegistryImpl_Stub.rebind(Unknown Source)
        at java.rmi.Naming.rebind(Naming.java:177)
        at sun.tools.jstatd.Jstatd.bind(Jstatd.java:57)
        at sun.tools.jstatd.Jstatd.bind(Jstatd.java:66)
        at sun.tools.jstatd.Jstatd.main(Jstatd.java:143)
Caused by: java.net.ConnectException: Connection timed out
        at java.net.PlainSocketImpl.socketConnect(Native Method)
        at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:339)
        at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:200)
        at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:182)
        at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
        at java.net.Socket.connect(Socket.java:579)
        at java.net.Socket.connect(Socket.java:528)
        at java.net.Socket.<init>(Socket.java:425)
        at java.net.Socket.<init>(Socket.java:208)
        at sun.rmi.transport.proxy.RMIDirectSocketFactory.createSocket(RMIDirectSocketFactory.java:40)
        at sun.rmi.transport.proxy.RMIMasterSocketFactory.createSocket(RMIMasterSocketFactory.java:147)
        at sun.rmi.transport.tcp.TCPEndpoint.newSocket(TCPEndpoint.java:613)
        ... 8 more

上面提示的ip很奇怪。这台机器的ip应该是10.234.10.12

运行hostname -i,显示为192.168.17.12

这是错误的IP,打开 /etc/hosts,发现里面配置了本机名cvs解析为192.158.17.12,这台机器以前换过ip,修改为10.234.10.12。

ok,jstatd可以正常运行了。