Re: [munin-users] log format for rsync & proftp plugins

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 454-5900

On Sat, 2007-06-09 at 09:08 +0200, Andrea Gozzi wrote:
> Concerning the rsyncd_* plugins:
> I instructed the deamon to change logging format but still data in
> rsyncd.log can't be processed:
> 
> 2007/06/09 08:47:32 [13396] rsyncd version 2.6.9 starting, listening on
> port 873
> 2007/06/09 08:48:04 [13410] connect from xxx.xxx.xxx (xx.xx.xx.xx)
> 2007/06/09 08:48:05 [13410] rsync to www from xxx.xxx.xxx (xx.xx.xx.xx)
> 2007/06/09 08:48:05 [13410] receiving file list
> 2007/06/09 08:48:05 [13410] (xx.xx.xx.xx) recv www::*** (1528 bytes).
> Total 48 bytes.
> 2007/06/09 08:48:05 [13410] (xx.xx.xx.xx) recv www::*** (1608 bytes).
> Total 48 bytes.
> 2007/06/09 08:48:05 [13410] (xx.xx.xx.xx) recv www::*** (1621 bytes).
> Total 48 bytes.
> 2007/06/09 08:48:05 [13410] (xx.xx.xx.xx) recv www::*** (1856 bytes).
> Total 48 bytes.

That log format matches mine.

> Actually the situation seems to have not changed at all:
> 
> bnix:/var/log# munin-run rsyncd_bytes
> /var/log/rsyncd.log: line 1: 2007/06/09: No such file or directory
> /var/log/rsyncd.log: line 2: syntax error near unexpected token `('
> /var/log/rsyncd.log: line 2: `2007/06/09 08:48:04 [13410] connect from
> xxx.xxx.xxx (xx.xx.xx.xx)'
> send.value 0
> recv.value 0
> 
> I rotated the logs and restarted rsyncd but with the same results.
> That's what how I configured rsyncd for logging:
> 
> transfer logging = yes
> log file = /var/log/rsyncd.log
> log format = (%a) %o %m::%f (%l bytes). Total %b bytes.

Can you confirm that your plugin-conf.d/munin-node contains:

	[rsyncd_*]
	group adm

Also, can you confirm that your plugins/rsyncd_* files contain the same
logfile name as your rsyncd.conf file.

        RSYNCD_LOG=${logfile:-/var/log/rsync.log}

Finally, if you have run the rsyncd_* plugins as root before using
munin-run, please make sure that
/var/lib/munin/plugin-state/rsync-*.offset are owned by nobody:munin
instead of root.

-Jim P.

> 
> On Fri, 2007-06-08 at 19:13 +0200, Andrea Gozzi wrote:
> > Both solutions are fine by me as long as logfiles are still
> > human-readable.
> > Thanks for the help,
> > 
> > Andrea
> > 
> > On Fri, 2007-06-08 at 11:59 -0400, Jim Popovitch wrote:
> > > On Fri, 2007-06-08 at 17:08 +0200, Andrea Gozzi wrote:
> > > > I'm trying to use the rsyncd plugin downloaded from the muninexchange
> > > > but it isn't working as it should.
> > > > The rsyncd host is running debian testing so I just changed the logging
> > > > facility (rsyncd.conf) from syslog to a separate logfile.
> > > > When I try to run manually the plugin ("munin-run rsyncd_bytes" or
> > > > "count") I get this output:
> > > > 
> > > > > bnix:/etc/munin/plugins# munin-run rsyncd_bytes 
> > > > > /var/log/rsyncd.log: line 1: 2007/05/27: No such file or directory
> > > > > /var/log/rsyncd.log: line 2: syntax error near unexpected token `('
> > > > > /var/log/rsyncd.log: line 2: `2007/05/27 09:41:12 [21983] connect from
> > > > > xxx.xxx.xxx (xxx.xxx.xxx.xxx)'
> > > > > send.value 0
> > > > > recv.value 0
> > > > 
> > > > So I guess there's something wrong with how rsyncd formats the logfile,
> > > > but I'm sure it was never changed from default.
> > > > Here's a portion:
> > > > 
> > > > 
> > > > > 2007/05/27 09:44:38 [21991] connect from xxx.xxx.xxx (xxx.xxx.xxx.xxx)
> > > > > 2007/05/27 09:44:39 [21991] rsync to www from xxx.xxx.xxx
> > > > > (xxx.xxx.xxx.xxx)
> > > > > 2007/05/27 09:44:39 [21991] receiving file list
> > > > > 2007/05/27 09:44:46 [21991] sent 38254 bytes  received 9234 bytes
> > > > > total size 3482399
> > > > > 2007/05/27 11:01:01 [29587] connect from xxx.xxx.xxx (xxx.xxx.xxx.xxx)
> > > > > 2007/05/27 11:01:01 [29587] rsync to db2 from xxx.xxx.xxx
> > > > > (xxx.xxx.xxx.xxx)
> > > > > 2007/05/27 11:01:01 [29587] receiving file list
> > > > > 2007/05/27 11:01:04 [29587] sent 6374 bytes  received 833 bytes  total
> > > > > size 622975
> > > > > 2007/05/27 11:01:04 [29589] connect from xxx.xxx.xxx (xxx.xxx.xxx.xxx)
> > > > > 2007/05/27 11:01:04 [29589] rsync to db3 from xxx.xxx.xxx
> > > > > (xxx.xxx.xxx.xxx)
> > > > > 2007/05/27 11:01:04 [29589] receiving file list
> > > 
> > > This is almost embarrassing.  I mucked up a plugin and didn't use
> > > default system settings.  My rsyncd.conf has these entries:
> > >     
> > >       log format = (%a) %o %m::%f (%l bytes). Total %b bytes.
> > > 
> > > So, that's the format of /var/log/rsync.log which the rsyncd_* plugins
> > > were tested against.  You can add that "log format" statement to your
> > > rsyncd.conf file for a quick fix... otherwise I'll see what I can do to
> > > get an updated copy put on PE.
> > > 
> > > 
> > > > Also, the same problem seems to happen with the proftp_bytes/count
> > > > plugins:
> > > > 
> > > > > bnix:/etc/munin/plugins# munin-run proftpd_bytes 
> > > > > /var/log/proftpd/xferlog: line 1: Tue: command not found
> > > > > /var/log/proftpd/xferlog: line 2: Tue: command not found
> > > > > /var/log/proftpd/xferlog: line 3: Tue: command not found
> > > > 
> > > > And so on..
> > > > The ftp daemon (proftpd) logfile looks like this:
> > > > 
> > > > > Sun May 27 09:22:37 2007 5 xxx.xxx.xxx 14603081 /backup-052007/storage/data/mysql_export.sql b _ i r admin ftp 1 * c
> > > > > Sun May 27 09:33:09 2007 13 xxx.xxx.xxx 485040 /backup-052007/storage/data/img/img00787.png b _ i r admin ftp 1 * c
> > > > > Sun May 27 09:43:29 2007 8 xxx.xxx.xxx 500618 /backup-052007/storage/data/img/img00788.png b _ i r admin ftp 1 * c
> > > > > Sun May 27 10:03:43 2007 602 xxx.xxx.xxx 118792 /backup-052007/storage/data/img/img00789.png b _ i r admin ftp 1 * i
> > > > 
> > > > How can I fix the two logs (or the munin plugins) to make them work?
> > > 
> > > In proftpd_count and proftpd_bytes, modify line 23 to be the logfile you
> > > are using.  Proftpd in Debian Testing seems to be drastically different
> > > than what's in Sarge.
> > > 
> > > -Jim P.
> > > 
> > > 
> > > 
> > > 
> > > -------------------------------------------------------------------------
> > > This SF.net email is sponsored by DB2 Express
> > > Download DB2 Express C - the FREE version of DB2 express and take
> > > control of your XML. No limits. Just data. Click to get it now.
> > > http://sourceforge.net/powerbar/db2/
> > > _______________________________________________
> > > munin-users mailing list
> > > mun...@li...
> > > https://lists.sourceforge.net/lists/listinfo/munin-users
> > -------------------------------------------------------------------------
> > This SF.net email is sponsored by DB2 Express
> > Download DB2 Express C - the FREE version of DB2 express and take
> > control of your XML. No limits. Just data. Click to get it now.
> > http://sourceforge.net/powerbar/db2/
> > _______________________________________________ munin-users mailing list mun...@li... https://lists.sourceforge.net/lists/listinfo/munin-users