This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Syslog 9.1 log to sql database error

Hello all,

I keep getting the below errors when trying to send info to our SQL database.

2010-10-10 16:49:39 DBLogger.ClearQueue aborted with error: Incorrect syntax near '2222:43:netmgtd:10-Oct-2010 16:49:37.018014:rca_ocp.c:295:INFO:25.2.4:GUI: Account admin from 10.X.X.XX logged in to 10.X.X.X'. - SQL statement has been removed from the database cache. [Syslogd_TaskEngine.exe 2.5.151] (801) INSERT INTO Syslogd (MsgDate,MsgTime,MsgPriority,MsgHostname,MsgText) VALUES ('2010-10-10','16:49:38','User.Info','10.X.X.XXX','2222:43:netmgtd:10-Oct-2010 16:49:37.018014:rca_ocp.c:295:INFO:25.2.4:GUI: Account admin from 10.X.X.XX logged in to 10.X.X.XXX. ') : C:\Program Files\Syslogd\DBCache\ca7ad33fa4e635d00d4106908427f600 [Line:0]

I have setup the the log to database using the built in sql file format as well as creating one from scratch.  What I don't get is that every time I use the debug command, the table gets updated properly without any errors.  But when I apply my settings the log file gets filled with errors.  I know it is complaining about quotes someplace, but in the view none of the statements have any quotes in them.  

 

Any help would be greatly appreciated.

 

Thank you,

Giuseppe

  • Hi Giuseppe,

    This issue can occur whenever the Syslog MessageText contains single quotes (').

    At this stage, the only workaround is to properly escape the any single quotes in the Message Text using a RunScript action, that runs *before* the "Log to Database" action.

    eg.

    Rule "My Log to Database Rule"

    Actions
       - RunScript "EscapeSingleQuotesInMessageText.vbs" (Full Read/Write Permissions)
       - Log to Database

    "EscapeSingleQuotesInMessageText.vbs"

    Function Main()

       ' Replace ' with '' within the message text field
       Fields.VarCleanMessageText = Replace(Fields.VarCleanMessageText, "'", "''")

       ' Return OK to tell syslog that the script ran correctly
       Main = "OK"

    End Function 

    Hope that Helps,

  • Thank you for your reply.  I tried your suggestion, however that did not solve the problem.  I am still getting a error log filled with "Incorrect syntax near" errors.

    I have attached some screen shots below.  The weird thing is that none of my notifications contain any singles quotes.

     

    Thanks in advance,

    Giuseppe

     

     

  • What DBMS are you logging to?

  • A MS Sql DB.  Just one.  The weird thing is that I can debug and enter in the exact same insert statement that the log file says failed, and it works without a problem.

  • It is possible that the Message Text contains some non-printable characters, like 0x00 (NULL)/0x0D(CR)/0x0A(LF) - which the DBMS can interpret as end of line, so the SQL statement looks incomplete.

    Try enabling this setting:

    Modifiers > Replace non printable characters with <ASCII value>

    This will convert all non-printables, like NULL into <00> instead.
    If there are any "non-printables" in the Message Text they'll show up after you apply this setting.

    -Kuz.

  • That did it!  Thank you very much for your help.