afsql [1]

The afsql module has only one driver, which is the sql() destination driver. The sql() driver sends messages to a SQL database.

Status

Architecture	Status
x86	Works
ARM	Works

Dependencies

This driver has multilevel dependencies. To compile the driver needs the libdbi and libdbi-drivers packages, which are supported and updated in the OSE forks,andshould work nicely both on ARM and X86 macOS systems now (tested on macOS 13.3.1 and 12.6.4)

Please do not use the pre-built ones (e.g. 0.9.0 from Homebrew), build from the master of the following

• https://github.com/balabit-deps/libdbi-drivers

• https://github.com/balabit-deps/libdbi

To use any specific database system you need the corresponding supporting system-specific packages as well.

Currently, the following databases are supported and tested

Type	Install	Architecture
sqlite(3)	brew install sqlite	x86/ARM
PostgreSQL	brew install postgresql	x86/ARM
mySQL	brew install mysql	x86/ARM
Oracle	Instant Client Download	x86

Testing

Configuration file used

@version: 4.2
@include "scl.conf"


source s_local0 {
    example-msg-generator(
        num(50)
        freq(1)
        template("Random Message")
    );
};

destination d_sql0 {
	sql(
		type(sqlite3) 
		database("test_db")
		table("msgs_${R_YEAR}${R_MONTH}${R_DAY}") 
		columns("datetime varchar (26)", "host varchar(32)",
				"program varchar(32)", "pid varchar(8)", "message varchar(4096)")
		values("${R_DATE}", "${HOST}", "${PROGRAM}", "${PID}", "${MSGONLY}")
		indexes("datetime", "host", "program", "pid")
	);
};

destination d_sql1 {
	sql(
		type(mysql) 
		host("your_host") port("3306")
		username("test_user") password("your_pass") 
		database("test_db")
		table("msgs_${R_YEAR}${R_MONTH}${R_DAY}") 
		columns("datetime varchar (26)", "host varchar(32)",
				"program varchar(32)", "pid varchar(8)", "message varchar(4096)")
		values("${R_DATE}", "${HOST}", "${PROGRAM}", "${PID}", "${MSGONLY}")
		indexes("datetime", "host", "program", "pid")

		quote_char("``")
	);
};

destination d_sql2 {
	sql(
		type(pgsql) 
		host("your_host") port("5432")
		username("test_user") password("your_pass") 
		database("test_db")
		table("msgs_${R_YEAR}${R_MONTH}${R_DAY}") 
		columns("datetime varchar (26)", "host varchar(32)",
				"program varchar(32)", "pid varchar(8)", "message varchar(4096)")
		values("${R_DATE}", "${HOST}", "${PROGRAM}", "${PID}", "${MSGONLY}")
		indexes("datetime", "host", "program", "pid")
	);
};

#
# DO NOT FORGET, no ARM64 Oracle OCCI Client !!!
#
destination d_sql3 {
	sql(
		type(oracle) 
		host("your_host") port("1521")
		username("test_user") password("your_pass") 
		database("XE")
		table("msgs_${R_YEAR}${R_MONTH}${R_DAY}") 
		columns("datetime varchar (26)", "host varchar(32)",
				"program varchar(32)", "pid varchar(8)", "message varchar(4000)")
		values("${R_DATE}", "${HOST}", "${PROGRAM}", "${PID}", "${MSGONLY}")
		indexes("datetime", "host", "program", "pid")
	);
};


log {
	source(s_local0);
	
	destination(d_sql0);
	destination(d_sql1);
	destination(d_sql2);
	destination(d_sql3);
	
	flags(flow-control);
};
#---------------------------------------------------------------------------

Proof

sqlite3

mySQL

PostgreSQL

Oracle