Package: rsyslog-pgsql
Version: 8.24.0-1
Severity: important
I've observed this problem on both jessie (8.4.2-1+deb8u2) and stretch
(8.24.0-1)
I installed the package:
apt-get install postgresql rsyslog-pgsql
and agreed to let dbconfig-common set up the database.
I restart the daemon:
systemctl restart rsyslog
Then I went to look at the table with loganalyzer[1] and I noticed the
PID values in the tag column in the GUI.
Looking in the database, I found the data is bad, rsyslog is not doing
the correct INSERT:
select distinct syslogtag from SystemEvents;
syslogtag
-------------------------
sshd[9127]:
cron[582]:
sshd[15202]:
sshd[15298]:
sshd[15071]:
sshd[15279]:
sshd[15116]:
rsyslogd-2007:
sshd[15114]:
CRON[26002]:
CRON[28224]:
sshd[9150]:
postfix/smtpd[26154]:
sshd[15207]:
CRON[11434]:
CRON[28163]:
sshd[9398]:
CRON[28103]:
select count(distinct processid) from SystemEvents;
count
-------
0
