Thank you!
This configuration works properly, and i got ProccessID in Adiscon LogAnalyzer
with this configuration:
$template SQLWithProcessID,"insert into SystemEvents (Message, Facility,
FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag,
ProcessID) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%,
'%timereported:::date-pgsql%', '%timegenerated:::date-pgsql%', %iut%,
'%syslogtag:R,ERE,1,FIELD:([a-zA-Z\/]+)(\[[0-9]{1,5}\])*:--end%',
'%syslogtag:R,ERE,1,BLANK:\[([0-9]{1,5})\]--end%')",sql
module(load="ompgsql")
*.* :ompgsql:localhost,Syslog,rsyslog,HIDDEN_PASSWORD;SQLWithProcessID
Thu, 18 Sep 2014 12:44:45 +0200 от Rainer Gerhards <[email protected]>:
>
>2014-09-18 12:36 GMT+02:00 Фадеев Виталий Львович < [email protected] > :
>>Is there possibly to add template to *.* :ompgsql ?
>
>add ";template" after all other parameters
>
>That's the legacy way of adding templates.
>
>Rainer
>
>>
>>Thu, 18 Sep 2014 12:26:44 +0200 от Rainer Gerhards < [email protected]
>>>:
>>
>>>2014-09-18 11:29 GMT+02:00 Фадеев Виталий Львович < [email protected] > :
>>>>
>>>>Hi there!
>>>>First, i want to ask: why there is no documentation for this module?
>>>
>>>nobody has written anything as it looks. Feel free to add a PR for the
>>>rsyslog-doc git project:
>>>
>>>https://github.com/rsyslog/rsyslog-doc
>>>
>>>>Two, why registration on forum is under basic authentication?
>>>
>>>too much spam without that
>>>>
>>>>I use ommysql with this configuration and this is worked:
>>>>
>>>>$template SQLWithProcessID,"insert into SystemEvents (Message, Facility,
>>>>FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag,
>>>>ProcessID) values ('%msg%', %syslogfacility%, '%HOSTNAME%',
>>>>%syslogpriority%, '%timereported:::date-mysql%',
>>>>'%timegenerated:::date-mysql%', %iut%,
>>>>'%syslogtag:R,ERE,1,FIELD:([a-zA-Z\/]+)(\[[0-9]{1,5}\])*:--end%',
>>>>'%syslogtag:R,ERE,1,BLANK:\[([0-9]{1,5})\]--end%')",sql
>>>>module(load="ommysql")
>>>>action(type="ommysql"
>>>> server="localhost"
>>>> serverport="3306"
>>>> db="Syslog"
>>>> uid="rsyslog"
>>>> pwd="HIDDEN"
>>>> template="SQLWithProcessID")
>>>>
>>>>But when i change to ompgsql like this:
>>>>
>>>>module(load="ompgsql")
>>>>action(type="ompgsql"
>>>> server="localhost"
>>>> serverport="5432"
>>>> db="Syslog"
>>>> uid="rsyslog"
>>>> pwd="HIDDEN")
>>>>
>>>>I get this error in messages:
>>>>
>>>>Sep 18 02:24:31 backup rsyslogd-2209: module name 'ompgsql' is unknown [try
>>>> http://www.rsyslog.com/e/2209 ]
>>>>Sep 18 02:24:31 backup rsyslogd-2207: error during parsing file
>>>>/etc/rsyslog.d/ompgsql.conf, on or before line 9: errors occured in file
>>>>'/etc/rsyslog.d/ompgsql.conf' around line 9 [try
>>>>http://www.rsyslog.com/e/2207
>>>>
>>>>But when i wrote this config:
>>>>
>>>>module(load="ompgsql")
>>>>*.* :ompgsql:localhost,Syslog,rsyslog,HIDDEN
>>>>
>>>>All works as expected.
>>>
>>>The module must support new-style syntax. ompgsql does not do so yet.
>>>
>>>>
>>>>I save this config file to /etc/rsyslog.d/ompgsql.conf
>>>>My system is Gentoo, rsyslog-7.6.3.
>>>>
>>>>Also. how to convert template SQLWithProcessID to use with PostgreSQL?
>>>
>>>*I* don't know and leave this to others.
>>>
>>>Rainer
>>>>_______________________________________________
>>>>rsyslog mailing list
>>>>http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>>http://www.rsyslog.com/professional-services/
>>>>What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
>>>>sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
>>>>LIKE THAT.
>>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
