On 28/04/17 12:28, Rainer Gerhards wrote:
> Well, syslogtag is syslogtag and so the contents is correct as far as I can > see. > > I think you can define a custom template for the insert, which > together with a schema modification should give you what you want? > Hi Rainer, thanks for the feedback. Ideally somebody should just be able to do: apt-get install rsyslog-pgsql loganalyzer and everything will appear correctly in the GUI. The rsyslog-pgsql package currently installs the schema file[1] which doesn't appear to have the processid column in it. However, in my own database, I see the ProcessID column. Does ompgsql create the column at runtime or is something else creating it? In any case, which file should be patched to add a ProcessName column as well? The package also installs /etc/rsyslog.d/pgsql.conf from this template[2] which contains: $ModLoad ompgsql *.* :ompgsql:_DBC_DBSERVER_,_DBC_DBNAME_,_DBC_DBUSER_,_DBC_DBPASS_ One thing that occurred to me is that things might behave differently when rsyslog is receiving RFC 5424 log events over the network, will the default configuration be putting the PID in the right column in that case? Or the ompgsql INSERT template is the same for both RFC-3164 and RFC-5424? I found the example of how to customize the INSERT in the manual page[4]. Would it be better for the maintainers of each package (Debian, Fedora, ...) to include individual customizations for this, or would it be better if it was part of ompgsql by default? Regards, Daniel 1. https://sources.debian.net/src/rsyslog/8.24.0-1/plugins/ompgsql/createDB.sql/ 2. https://sources.debian.net/src/rsyslog/8.24.0-1/debian/rsyslog-pgsql.conf.template/ 3. https://www.ietf.org/rfc/rfc3164.txt 4. http://www.rsyslog.com/doc/v8-stable/configuration/modules/ompgsql.html
