On 28/04/17 12:16, Michael Biebl wrote: > Control: tags -1 + moreinfo > > Am 28.04.2017 um 11:51 schrieb Daniel Pocock: >> Package: rsyslog-pgsql Version: 8.24.0-1 Severity: important >> >> I've observed this problem on both jessie (8.4.2-1+deb8u2) and >> stretch (8.24.0-1) >> >> I installed the package: >> >> apt-get install postgresql rsyslog-pgsql >> >> and agreed to let dbconfig-common set up the database. >> >> I restart the daemon: >> >> systemctl restart rsyslog >> >> Then I went to look at the table with loganalyzer[1] and I >> noticed the PID values in the tag column in the GUI. >> >> Looking in the database, I found the data is bad, rsyslog is not >> doing the correct INSERT: >> >> >> select distinct syslogtag from SystemEvents; >> >> >> >> syslogtag ------------------------- sshd[9127]: cron[582]: >> sshd[15202]: sshd[15298]: sshd[15071]: sshd[15279]: sshd[15116]: >> rsyslogd-2007: sshd[15114]: CRON[26002]: CRON[28224]: >> sshd[9150]: postfix/smtpd[26154]: sshd[15207]: CRON[11434]: >> CRON[28163]: sshd[9398]: CRON[28103]: >> > > I'm not sure that's a bug, see > https://www.ietf.org/rfc/rfc3164.txt: > > 5.3 Originating Process Information > > It has also been considered to be a good practice to include some > information about the process on the device that generated the > message - if that concept exists. This is usually the process > name and process id (often known as the "pid") for robust > operating systems. The process name is commonly displayed in the > TAG field. Quite often, additional information is included at the > beginning of the CONTENT field. The format of "TAG[pid]:" - > without the quote marks - is common. >
Using the square brackets for the PID is a clearly documented standard and the table has the separate column for it. Maybe there should be distinct columns for "full" tag and also for the extracted process name and PID? Or should processes reading this table, such as LogAnalyzer, be able to extract the PID? When I was using the MongoDB backend the PID was in a different column. Can anybody else in the rsyslog mailing list comment on this issue? Regards, Daniel
