Re: How to remove hosts from Syslog-ng plugin

Hi Wagner,




2012/4/5 Wagner Pereira <[email protected]>

> (...)
> I need to do two things:
>
> 1. To block new unauthorized hosts to log on it and
>

It is advisable that you enable a host firewall at your server to only
accept syslog messages from your authorized hosts.


> 2. Remove hosts from the list
>

You can delete the hosts from the table named "syslog" that stores the
hosts information in the database named "syslog" in the MySQL server that
runs for you Cacti instance.

Before touching the MySQL database and remove the records, it is advised to
perform a backup of all mysql databases beforehand.


Remove of the host is simple to do if you run the phpMyAdmin web tool.
http://www.phpmyadmin.net/

If you do not have phpMyAdmin, removing the undesired host entry is also
simple to accomplish with MySQL CLI commands.

You can execute MySQL commands directly from the Bash command line using
the -e flag. There are also some useful shortcut  mysql commands like:

Syntax:
mysqlshow [database] syslog

Example:
mysqlshow syslog


Syntax:
mysql -u [mysql-user] -p [mysql-user-password] -e "[mysql commands]"

Examples:
mysql -u cacti -p cacti -e "show databases;"

mysql -u cacti -p cacti -e "use syslog; show tables;"

mysql -u cacti -p cacti -e "select * from syslog;"

mysql -u cacti -p cacti -e "show columns from syslog;"


To select and show the relevant records:

Syntax:
mysql -u cacti -p cacti -e "SELECT * FROM [table name] WHERE [field name] =
'whatever';"

Example:
mysql -u cacti -p cacti -e "SELECT * FROM syslog WHERE host = 'hostname';"
# hostname can be changed to ip_address

If you manage to find the records from the host that you want to remove,
you just need to issue the commands to find and delete those records.

Delete a row(s) from a table.

Syntax:
mysql -u cacti -p cacti -e "DELETE from [table name] where [field name] =
'whatever';

Example:
mysql -u cacti -p cacti -e "DELETE from syslog where host = '10.0.0.1';


Take care,

Alex


> I appreciate any help.
>
> Best wishes...
>
> --
> Wagner Pereira
> PoP-SP/RNP - Ponto de Presença da RNP em São Paulo
> http://www.pop-sp.rnp.br
> Fixo. +55 11 3091-9799
> Móvel. +55 11 9923-9554
> fone@RNP. 011-1015-8902
>
> ### At PoP-SP/RNP, every day is an IPv6 day ###
>
>
>
> ------------------------------------------------------------------------------
> Better than sec? Nothing is better than sec when it comes to
> monitoring Big Data applications. Try Boundary one-second
> resolution app monitoring today. Free.
> http://p.sf.net/sfu/Boundary-dev2dev
> _______________________________________________
> cacti-user mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/cacti-user
>
------------------------------------------------------------------------------
For Developers, A Lot Can Happen In A Second.
Boundary is the first to Know...and Tell You.
Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
http://p.sf.net/sfu/Boundary-d2dvs2