2017-04-28 12:25 GMT+02:00 Daniel Pocock <[email protected]>: > > > On 28/04/17 12:16, Michael Biebl wrote: >> Control: tags -1 + moreinfo >> >> Am 28.04.2017 um 11:51 schrieb Daniel Pocock: >>> Package: rsyslog-pgsql Version: 8.24.0-1 Severity: important >>> >>> I've observed this problem on both jessie (8.4.2-1+deb8u2) and >>> stretch (8.24.0-1) >>> >>> I installed the package: >>> >>> apt-get install postgresql rsyslog-pgsql >>> >>> and agreed to let dbconfig-common set up the database. >>> >>> I restart the daemon: >>> >>> systemctl restart rsyslog >>> >>> Then I went to look at the table with loganalyzer[1] and I >>> noticed the PID values in the tag column in the GUI. >>> >>> Looking in the database, I found the data is bad, rsyslog is not >>> doing the correct INSERT: >>> >>> >>> select distinct syslogtag from SystemEvents; >>> >>> >>> >>> syslogtag ------------------------- sshd[9127]: cron[582]: >>> sshd[15202]: sshd[15298]: sshd[15071]: sshd[15279]: sshd[15116]: >>> rsyslogd-2007: sshd[15114]: CRON[26002]: CRON[28224]: >>> sshd[9150]: postfix/smtpd[26154]: sshd[15207]: CRON[11434]: >>> CRON[28163]: sshd[9398]: CRON[28103]: >>> >> >> I'm not sure that's a bug, see >> https://www.ietf.org/rfc/rfc3164.txt: >> >> 5.3 Originating Process Information >> >> It has also been considered to be a good practice to include some >> information about the process on the device that generated the >> message - if that concept exists. This is usually the process >> name and process id (often known as the "pid") for robust >> operating systems. The process name is commonly displayed in the >> TAG field. Quite often, additional information is included at the >> beginning of the CONTENT field. The format of "TAG[pid]:" - >> without the quote marks - is common. >> > > Using the square brackets for the PID is a clearly documented standard > and the table has the separate column for it. > > Maybe there should be distinct columns for "full" tag and also for the > extracted process name and PID? > > Or should processes reading this table, such as LogAnalyzer, be able > to extract the PID? > > When I was using the MongoDB backend the PID was in a different column. > > Can anybody else in the rsyslog mailing list comment on this issue?
Well, syslogtag is syslogtag and so the contents is correct as far as I can see. I think you can define a custom template for the insert, which together with a schema modification should give you what you want? Rainer > > Regards, > > Daniel > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT.
