Save log apartir de Rsyslog to mysql database

 install en opensuse :
http://wiki.rsyslog.com/index.php/OpenSUSE

to erase the syslog by rsyslog
(hadi se fait seul )

Replacing stock syslogd

After installing rsyslog3, stop the syslog daemon:

/etc/init.d/syslog stop

Eedit the file /etc/sysconfig/syslog and change the following options to:

SYSLOG_DAEMON="rsyslog"

1-edite le fichier /etc/rsyslog.conf :
 ----ajout :
# rsyslog v3: load input modules
# If you do not load inputs, nothing happens!
$ModLoad ommysql #pour le mysql 
----ajout :
CREATE DATABASE Syslog;
USE Syslog;
CREATE TABLE SystemEvents
(
        ID int unsigned not null auto_increment primary key,
        CustomerID bigint,
        ReceivedAt datetime NULL,
        DeviceReportedTime datetime NULL,
        Facility smallint NULL,
        Priority smallint NULL,
        FromHost varchar(60) NULL,
        Message text,
        NTSeverity int NULL,
        Importance int NULL,
        EventSource varchar(60),
        EventUser varchar(60) NULL,
        EventCategory int NULL,
        EventID int NULL,
        EventBinaryData text NULL,
        MaxAvailable int NULL,
        CurrUsage int NULL,
        MinUsage int NULL,
        MaxUsage int NULL,
        InfoUnitID int NULL ,
        SysLogTag varchar(60),
        EventLogType varchar(60),
        GenericFileName VarChar(60),
        SystemID int NULL
);

CREATE TABLE SystemEventsProperties
(
        ID int unsigned not null auto_increment primary key,
        SystemEventID int NULL ,
        ParamName varchar(255) NULL ,
        ParamValue text NULL
);

----- ajout :
#*.*;mail.none;news.none            -/var/log/messages
 *.*   :ommysql:database-server,database-name,database-userid,database-password

restart le syslog
/etc/rc.d/syslog restart