Tools

Kiwi Syslog Crashes When Logging Messages to MySQL Database

This article explains how to resolve an error that causes Kiwi Syslog Server to crash when attempting to log a message onto a mySQL database.

First published date

11/5/2018 9:26 PM

Last published date

11/5/2018 9:26 PM

Overview

How to resolve an error that causes Kiwi Syslog Server to crash when attempting to log a message onto a MySQL database.

Environment 

  • Kiwi Syslog Server
  • MySQL Database

Product section

Kiwi Syslog Server

Cause

This happens on certain syslog messages, such as:

Aug 14 09:11:03 MYSERVER microsoft-windows-user profiles service[warning] 1530 NT AUTHORITY
SYSTEM Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registryfile may not function properly afterwards. DETAIL - 5 user registry handles leaked from \\Registry\\User
S-1-5-21-42362435234-1453063816-26470555-2269:Process 384 (\\Device\\HarddiskVolume2\\Windows\\System32
svchost.exe) has opened key \\REGISTRY\\USER
S-1-5-21-42362435234-1453063816-26470555-2269Process 420 (\\Device\\HarddiskVolume2\\Windows\\System32
svchost.exe) has opened key \\REGISTRY\\USER\\S-1-5-21-42362435234-1453063816-26470555-2269\\Printers
DevModePerUserProcess 384 (\\Device\\HarddiskVolume2\\Windows\\System32
svchost.exe) has opened key \\REGISTRY\\USER\\S-1-5-21-42362435234-1453063816-26470555-2269\\Software\\Microsoft\\Windows\\CurrentVersion
Internet Settings
ConnectionsProcess 384 (\\Device\\HarddiskVolume2\

The system stops logging messages to the database when it receives a specific log containing " \\ ". 

DB error "DBLogger.ClearQueue aborted with error: Database error executing SQL statement: [MySQL][ODBC 5.1 Driver][mysqld-5.7.17-log]You have an error in your SQL syntax"

Resolution

Configure the message format to increase the accepted message ("MsgText") length. In Kiwi Syslog Service Manager, click File > Setup > Modifiers > edit Maximum message length to a number greater than the largest message received from the monitored device.

Increasing the message length size avoids the " \ " character at the end of a message, which is recognized in the database as a syntax error.