Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: RSyslog: users

UUID for log lines

 

 

RSyslog users RSS feed   Index | Next | Previous | View Threaded


jerome.renard at gmail

Aug 13, 2012, 9:01 AM

Post #1 of 5 (268 views)
Permalink
UUID for log lines

Hi,

I need to get a UUID [1] for each log line processed by Rsyslog so I
can send it along with the traditionnal log informations (facility,
severity, message etc).

I checked in the configuration system and I found nothing.

My use case is the following : I need to send each log line to two
different storage systems. However I need to identify them in Mysql
and Postgres in parallel (the message is actually duplicated for
totally different use cases/contexts). Using a UUID is perfect for my
user case as I can check that a log line is available in both
storages.

In case a UUID is not available in Rsyslog, I think I will need to
write a plugin for this.
I need to reuse the UUID when I send data to MySQL and PostgreSQL so I
can get the following configuration:

$ModLoad ommysql
$ModLoad ompgsql

$template sqlinsert,"insert into systemevents (EventID, Message)
values('%UUID%', '%msg%');", SQL
*.* :ommysql:127.0.0.1,rsyslog,rsyslog,rsyslog;sqlinsert
*.* :ompgsql:127.0.0.1,rsyslog,rsyslog,rsyslog;sqlinsert

I am afraid the only solution for me would be to add a new property
which means (unless I am mistaken) patching Rsyslog's core, but I do
not have much experience with Rsyslog and maybe I overlooked
something. Am I correct ?

Thanks in advance for your feedback/comments

Best Regards,

1. https://en.wikipedia.org/wiki/UUID

--
Jérôme
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


david at lang

Aug 13, 2012, 10:53 AM

Post #2 of 5 (248 views)
Permalink
Re: UUID for log lines [In reply to]

On Mon, 13 Aug 2012, Jerome Renard wrote:

> Hi,
>
> I need to get a UUID [1] for each log line processed by Rsyslog so I
> can send it along with the traditionnal log informations (facility,
> severity, message etc).
>
> I checked in the configuration system and I found nothing.
>
> My use case is the following : I need to send each log line to two
> different storage systems. However I need to identify them in Mysql
> and Postgres in parallel (the message is actually duplicated for
> totally different use cases/contexts). Using a UUID is perfect for my
> user case as I can check that a log line is available in both
> storages.
>
> In case a UUID is not available in Rsyslog, I think I will need to
> write a plugin for this.
> I need to reuse the UUID when I send data to MySQL and PostgreSQL so I
> can get the following configuration:
>
> $ModLoad ommysql
> $ModLoad ompgsql
>
> $template sqlinsert,"insert into systemevents (EventID, Message)
> values('%UUID%', '%msg%');", SQL
> *.* :ommysql:127.0.0.1,rsyslog,rsyslog,rsyslog;sqlinsert
> *.* :ompgsql:127.0.0.1,rsyslog,rsyslog,rsyslog;sqlinsert
>
> I am afraid the only solution for me would be to add a new property
> which means (unless I am mistaken) patching Rsyslog's core, but I do
> not have much experience with Rsyslog and maybe I overlooked
> something. Am I correct ?

I don't believe that rsyslog provides this directly. I believe that you
would want to generate a strgen module to create the UUID.

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


jerome.renard at gmail

Aug 13, 2012, 11:26 AM

Post #3 of 5 (247 views)
Permalink
Re: UUID for log lines [In reply to]

Hi David, thanks for your feedback

On Mon, Aug 13, 2012 at 7:53 PM, <david [at] lang> wrote:
[...]
>
>
> I don't believe that rsyslog provides this directly. I believe that you
> would want to generate a strgen module to create the UUID.
>

Could you please elaborate ? (I'll have a look at strgen in the
meanwhile, but just in case you have more informations to share about
strlen).

--
Jérôme
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


rgerhards at hq

Aug 13, 2012, 1:18 PM

Post #4 of 5 (252 views)
Permalink
Re: UUID for log lines [In reply to]

It would probably make sense to implement a system property $!uuid (or so) which, when used, generates a new UUID inside the template. One needs to think that only a single uuid must be generated per message, no matter in how many templates this is used. Msg.c would be the main place to implement such a thing.

Rainer

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Jerome Renard
> Sent: Monday, August 13, 2012 8:26 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] UUID for log lines
>
> Hi David, thanks for your feedback
>
> On Mon, Aug 13, 2012 at 7:53 PM, <david [at] lang> wrote:
> [...]
> >
> >
> > I don't believe that rsyslog provides this directly. I believe that
> you
> > would want to generate a strgen module to create the UUID.
> >
>
> Could you please elaborate ? (I'll have a look at strgen in the
> meanwhile, but just in case you have more informations to share about
> strlen).
>
> --
> Jérôme
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


jerome.renard at gmail

Aug 22, 2012, 8:00 AM

Post #5 of 5 (219 views)
Permalink
Re: UUID for log lines [In reply to]

Hello,

As a follow up I filed an issue [1] in the bugtracker and attached a
"patch" to it.

Have a nice day :)

1. http://bugzilla.adiscon.com/show_bug.cgi?id=353

--
Jérôme
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

RSyslog users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.