To analyze postgres logs, our workflow is:
- postgres logs via syslog
- rsyslog writes to one text file
- at midnight we stop postgres
- pgbadger reads and parses the daily logfile (about 2 Gbyte)
We want to esclude some outliers, for examples when the application starts, because for us they are useless data and just pollute the logfile.
To accomplish this: how/where can I specify a working hours (from..to) filter ?
The ideal solution is to set the filter in postgres.
Less than ideal, filter at rsyslog.
Last choice is to filter at pgbadger: the html output will be trimmed, but our servers keep writing fat logfiles.
current rsyslog configuration:
:msg, contains, "connection authorized: user=root database=root" ~ :msg, contains, "FATAL: database \"root\" does not exist" ~ local0.* -/var/log/postgresql.log