Syslog table drop with no apparent reason

[arno-st]

On cacti 1.2.30 and Syslog 4.2 some table are DROP for no reason.
This happen on syslog_remove, and syslog_alert, at least that are the 2 that I'm concern. Since I had to recreate my filter every once in a while.

Here is that happen on the db at that time:

ALTER TABLE `syslog_prod`.`syslog` REORGANIZE PARTITION dMaxValue INTO ( PARTITION d20260405 
VALUES LESS THAN (TO_DAYS(\'2026-04-06\')), PARTITION dMaxValue VALUES LESS THAN MAXVALUE)

DROP TABLE plugin_flowview_raw_2026086

ALTER TABLE `syslog_prod`.`syslog` DROP PARTITION d20260306

DROP TABLE IF EXISTS `syslog_prod`.`syslog`'

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog` (facility_id int(10) unsigned default NULL, priority_id int(10) unsigned default NULL, program_id int(10) unsigned default NULL, host_id int(10) unsigned default NULL, logtime DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00', message varchar(1024) NOT NULL default '', seq bigint unsigned NOT NULL auto_increment, PRIMARY KEY(seq, logtime), INDEX `seq` (`seq`), INDEX logtime (logtime), INDEX program_id (program_id), INDEX host_id (host_id), INDEX priority_id (priority_id), INDEX facility_id (facility_id)) 
ENGINE=InnoDB 
ROW_FORMAT=Dynamic 
PARTITION BY RANGE (TO_DAYS(logtime)) ( PARTITION d20260304 VALUES LESS THAN (TO_DAYS(\'2026-03-05\')), PARTITION d20260305 VALUES LESS THAN (TO_DAYS(\'2026-03-06\')), PARTITION d20260306 VALUES LESS THAN (TO_DAYS(\'2026-03-07\')), PARTITION d20260307 VALUES LESS THAN (TO_DAYS(\'2026-03-08\')), PARTITION d20260308 VALUE
S LESS THAN (TO_DAYS(\'2026-03-09\')), PARTITION d20260309 VALUES LESS THAN (TO_DAYS(\'2026-03-10\')), PART

DROP TABLE IF EXISTS `syslog_prod`.`syslog_alert`

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_alert` ( `id` int(10) NOT NULL auto_increment, `hash` varchar(32) NOT NULL default '', `name` varchar(255) NOT NULL default '', `severity` int(10) UNSIGNED NOT NULL default '0', `method` int(10) unsigned NOT NULL default '0', `level` int(10) unsigned NOT NULL default '0', `num` int(10) unsigned NOT NULL default '1', `type` varchar(16) NOT NULL default '', `enabled` CHAR(2) default 'on', `repeat_alert` int(10) unsigned NOT NULL default '0', `open_ticket` CHAR(2) default '', `message` VARCHAR(2048) NOT NULL default '', `body` VARCHAR(8192) NOT NULL default '', `user` varchar(32) NOT NULL default '', `date` int(16) NOT NULL default '0', `email` varchar(255) default NULL, `notify` int(10) unsigned NOT NULL default '0', `command` varchar(255) default NULL, `notes` varchar(255) default NULL, PRIMARY KEY (id)) ENGINE=InnoDB

DROP TABLE IF EXISTS `syslog_prod`.`syslog_incoming`

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_incoming` ( facility_id int(10) unsigned def
ault NULL, priority_id int(10) unsigned default NULL, program varchar(40) default NULL, logtime TIMESTAMP NOT NULL DEFAULT \'0000-00-00 00:00:00\', host varchar(64) default NULL, message varchar(2048) NOT N
ULL DEFAULT \'\', seq bigint unsigned NOT NULL auto_increment, `status` tinyint(4) NOT NULL default \'0\', PRIMARY KEY (seq), INDEX program (program), INDEX `status` (`status`)) ENGINE=InnoDB ROW_FORMAT=Dyn
amic'

DROP TABLE IF EXISTS `syslog_prod`.`syslog_remove`

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_remove` ( id int(10) NOT NULL auto_increment
, `hash` varchar(32) NOT NULL default \'\', name varchar(255) NOT NULL default \'\', `type` varchar(16) NOT NULL default \'\', enabled CHAR(2) DEFAULT \'on\', method CHAR(5) DEFAULT \'del\', message VARCHAR
(2048) NOT NULL default \'\', `user` varchar(32) NOT NULL default \'\', `date` int(16) NOT NULL default \'0\', notes varchar(255) default NULL, PRIMARY KEY (id)) ENGINE=InnoDB ROW_FORMAT=Dynamic',0
20260405 00:00:26,DBSERVER,syslog_prod,CACTISRV,11628814,5274115580,QUERY,syslog_prod,'DROP TABLE IF EXISTS `syslog_prod`.`syslog_reports`'

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_reports` ( id int(10) NOT NULL auto_increment, `hash` varchar(32) NOT NULL default \'\', name varchar(255) NOT NULL default \'\', `type` varchar(16) NOT NULL default \'\', enabled CHAR(2) DEFAULT \'on\', timespan int(16) NOT NULL default \'0\', timepart char(5) NOT NULL default \'00:00\', lastsent int(16) NOT NULL default \'0\', body varchar(8192) NOT NULL default \'0\', message varchar(2048) default NULL, `user` varchar(32) NOT NULL default \'\', `date` int(16) NOT NULL default \'0\', email varchar(255) default NULL, notify int(10) unsigned NOT NULL default \'0\', notes varchar(255) default NULL, PRIMARY KEY (id)) ENGINE=InnoDB ROW_FORMAT=Dynamic

DROP TABLE IF EXISTS `syslog_prod`.`syslog_hosts`

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_programs` ( `program_id` int(10) unsigned NO
T NULL auto_increment, `program` VARCHAR(40) NOT NULL, `last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP, PRIMARY KEY (`program`), INDEX host_id (`program_id`), INDEX l
ast_updated (`last_updated`)) ENGINE=InnoDB ROW_FORMAT=Dynamic COMMENT=\'Contains all programs currently in the syslog table\'

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_hosts` ( `host_id` int(10) unsigned NOT NULL auto_increment, `host` VARCHAR(64) NOT NULL, `last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP, PRIMARY KEY (`host`), INDEX host_id (`host_id`), INDEX last_updated (`last_updated`)) ENGINE=InnoDB ROW_FORMAT=Dynamic COMMENT='Contains all hosts currently in the syslog table'

DROP TABLE IF EXISTS `syslog_prod`.`syslog_facilities`

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_facilities` ( `facility_id` int(10) unsigned NOT NULL, `facility` varchar(10) NOT NULL, `last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP, PRIMARY KEY  (`facility_id`), INDEX last_updated (`last_updated`)) ENGINE=InnoDB ROW_FORMAT=Dynamic',0

DROP TABLE IF EXISTS `syslog_prod`.`syslog_priorities`

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_priorities` ( `priority_id` int(10) unsigned  NOT NULL, `priority` varchar(10) NOT NULL, `last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP, PRIMARY KEY (`priority_id`), INDEX last_updated (`last_updated`)) ENGINE=InnoDB ROW_FORMAT=Dynamic

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_host_facilities` ( `host_id` int(10) unsigned NOT NULL, `facility_id` int(10) unsigned NOT NULL, `last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP, PRIMARY KEY  (`host_id`,`facility_id`)) ENGINE=InnoDB ROW_FORMAT=Dynamic

DROP TABLE IF EXISTS `syslog_prod`.`syslog_removed`

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_removed` LIKE `syslog_prod`.`syslog`

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_logs` ( alert_id int(10) unsigned not null default \'0\', logseq bigint unsigned NOT NULL, logtime TIMESTAMP NOT NULL default \'0000-00-00 00:00:00\', logmsg varchar(1024) default NULL, host varchar(64) default NULL, facility_id int(10) unsigned default NULL, priority_id int(10) unsigned default NULL, program_id int(10) unsigned default NULL, count integer unsigned NOT NULL default \'0\', html blob default NULL, seq bigint unsigned NOT NULL auto_increm
ent, PRIMARY KEY (seq), INDEX `logseq` (`logseq`), INDEX `program_id` (`program_id`), INDEX `alert_id` (`alert_id`), INDEX `host` (`host`), INDEX `logtime` (`logtime`), INDEX `priority_id` (`priority_id`), INDEX `facility_id` (`facility_id`)) ENGINE=InnoDB ROW_FORMAT=Dynamic

CREATE TABLE IF NOT EXISTS `syslog_prod`.`syslog_statistics` ( `id` bigint UNSIGNED auto_increment, `host_id` int(10) UNSIGNED NOT NULL, `facility_id` int(10) UNSIGNED NOT NULL, `priority_id` int(10) UNSIGNED NOT NULL, `program_id` int(10) unsigned default NULL, `insert_time` TIMESTAMP NOT NULL, `records` int(10) UNSIGNED NOT NULL, PRIMARY KEY (`id`), UNIQUE KEY `unique_pk` (`host_id`, `facility_id`, `priority_id`, `program_id`, `insert_time`), INDEX `host_id`(`host_id`), INDEX `facility_id`(`facilit
y_id`), INDEX `priority_id`(`priority_id`), INDEX `program_id` (`program_id`), INDEX `insert_time`(`insert_time`)) ENGINE=InnoDB ROW_FORMAT=Dynamic COMMENT='Maintains High Level Statistics'

TRUNCATE `syslog_prod`.`syslog_statistics`

I didn't find yet which function is called who provoke that.

[TheWitness]

Is this the latest GitHub or the 4.2 tag?

[TheWitness]

I have to edit your post to make it a bit more readable.

[arno-st]

Yes I did a update before doing the post, so latest dev branch.

[TheWitness]

Yea, you might have some issues with the latest develop. Be advised. WRT this database, is the syslog database a stand alone database? Could it be you have a dev instance also pointing to it?

[TheWitness]

Are these lines commented out in your syslog config.php?

[arno-st]

A standalone one and no my test server, is going to another DB. I double check.
Yes, Those line are commented

[TheWitness]

Okay, the only way that the dropping happens is when you re-install the plugin. The default should be to upgrade, but let me check that again. So, if for some reason, someone else is installing Cacti on another system and by chance using your syslog plugins config.php and you have the permissions too open on the Syslog database, this could happen.

[TheWitness]

Check these variables in the settings table.

[arno-st]

Hmm here it is:
syslog_install_upgrade_type | truncate
syslog_install_engine | innodb
syslog_install_db_type | part
syslog_install_days | 30

And I'm the only one who tuch Cacti and all the DB releated to it.
For prod an test.

[TheWitness]

Well, for your sake, change the syslog_install_upgrade_type to 'upgrade' and the deletion will not happen again. Somehow a forced install is taking place somewhere. Make sure your permissions are locked down at least ALL permission to just the production Cacti instance in the mean time. You can grant select more liberally, but not 'ALL'.

[arno-st]

Ok will do that
thanks

[TheWitness]

Keeping this open for the moment till we hear back from you @arno-st.