MonitorWare Knowledge Base

Hi,

The column ProcessID is empty at my phpLogCon.
rsyslog writes the process ID's into the column Syslogtag together with the processname..
example: crond[15406]:

Anybody an idea what's wrong?

System is RHEL 5.2
rsyslog version: 1.3.0
phplogcon version: 2.5.14

Regards,
Marcus

• Custom phpLogCon configuration?
• Maintenance Contract?
• Installation support?

It seems like that the processid is not properly detected, I am going to reproduce this problem next week as I am currently out of office.

--
regards,
Andre

I see the same problem on my installation... will watch here for possible solution.
Mine shows the full syslogtag in syslogtag column (crond[9240]:) which it seems is how it is stored in the database.
Is phpLogCon supposed to be separating the app-name and process id or is the data getting inserted wrong?

mwani001 wrote:The column ProcessID is empty at my phpLogCon.
rsyslog writes the process ID's into the column Syslogtag together with the processname..
example: crond[15406]:

Anybody an idea what's wrong?

nothing

ProcessID is a field not yet known in any syslog standard. It is part of the upcoming new IETF RFC syslog series, most notably syslog-protocol.

As of RFC3164, [ terminates the tag, BUT than this is part of the message, e.g.

crond[15406]: blah

is: tag: "crond", msg: "[15406]: blah". This is not what the typical sysadmin expects as the message content, and thus rsyslog uses the more traditional definition that everything is tag upto the next space.

If you would like to strip the process id (or put it into a separate field), you must have a look at the property replace and must define a custom template for your database insert (or file write). rsyslog exposes all properties, you just need to use them. A good starting point is here:

http://www.rsyslog.com/doc-property_replacer.html

Please note that we also offer a custom config file creation service @ Euro29 - if you are from the corporate world, this may be useful to save you time

Rainer