0

Im setting up a centralized rsyslog server using a Raspberry Pi with LogAnalyzer web frontend to view the logs. Everything is setup and working except the parsing of fields into the MySQL database. As you can see in the attached image, the ProcessID column is not being populated, and its instead being stuck onto the end of the contents of the Syslogtag column.

Im looking to separate the syslogtag into the programname and procid fields. To my understanding Im to do this using a template placed in a rsyslog.d/*.conf file.

The most useful tutorial Ive found on the subject is here.

Ive also read and tried to put to use the documentation without success here and here.

Below is the config file I have at rsyslog.d/.conf

### Configuration file for rsyslog-mysql
### Changes are preserved

module (load="ommysql")
*.* action(type="ommysql" server="localhost" db="Syslog" uid="rsyslog" pwd="password")

# database template that separates the process ID from the syslog tag
$template dbFormat,"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag, processid) values ('%msg%', %syslogfacility%, '%HOSTNAME%',%syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag:R,ERE,1,FIELD:(.+)(\[[0-9]{1,5}\]).*--end%', '%syslogtag:R,ERE,1,BLANK:\[([0-9]{1,5})\]--end%')",sql

Screencap of Adiscon LogAnalyzer Version 4.1.5 Web Frontend for rsyslog

0

1 Answer 1

0

I figured it out. After finding some relevant examples, I noticed my problem was two fold. Firstly, I was not specifying the template before adding it to the action arguments. Secondly, I was not specifying the template name during the action arguments.

My config now looks like this:

### Configuration file for rsyslog-mysql
### Changes are preserved

# database template that separates the process ID from the syslog tag
$template dbFormat,"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag, processid) values ('%msg%', %syslogfacility%, '%HOSTNAME%',%syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag:R,ERE,1,FIELD:(.+)(\[[0-9]{1,5}\]).*--end%', '%syslogtag:R,ERE,1,BLANK:\[([0-9]{1,5})\]--end%')",sql

module (load="ommysql")
*.* action(type="ommysql" server="localhost" db="Syslog" uid="rsyslog" pwd="password" template="dbFormat")
1
  • Works perfectly. Just mind you - that if the PID's are going up (above 9999 ) the {1,5} clause will no longer work. I put {1,10} and it works as a charm for all processes now. Jan 15 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.