1

I'm forwarding logs from local rsyslogs to central rsyslog and then to Elasticsearch. Everything works fine, but entries with severity error generated by rsyslog itself have property programname like rsyslog-2222 or rsyslog-2039 which disrupts aggregation in Elasticsearch. Can't find any info what those numbers are. They are not random and they are not PIDs for sure.

Why rsyslog does this?

Can those numbers be removed on rsyslog level?

Example logs:

2019-08-07T19:48:00+02:00 rsyslogd-2039 err     Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]
2019-08-07T19:48:00+02:00 rsyslogd-2007 warning action 'action 10' suspended, next retry is Wed Aug  7 19:48:30 2019 [v8.16.0 try http://www.rsyslog.com/e/2007 ]
2019-08-07T19:00:39+02:00 rsyslogd-2222 err     command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]
2019-08-07T19:00:39+02:00 rsyslogd-2039 err     Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]
2019-08-07T19:00:39+02:00 rsyslogd-2007 warning action 'action 10' suspended, next retry is Wed Aug  7 19:01:09 2019 [v8.16.0 try http://www.rsyslog.com/e/2007 ]
  • Please add to your post an example of the error message. You can replace with x any information you might think is confidential, like IP addresses etc. – meuh Aug 8 '19 at 11:41
  • 1
    @meuh, I've added to the question some example entries. Non-warn/err entries have rsyslog programname. I've just found a solution for this. Look below. – Seweryn Niemiec Aug 9 '19 at 8:47
1

Property programname is created by parsing syslogtag. It looks like syslogtag is not super standarized. In my case it's better to use app-name prop, it's a field from IETF draft draft-ietf-syslog-protocol. I've just replaced

property(name="programname")

with

property(name="app-name")

and no more strange program names so far.

| improve this answer | |
1

From your examples, it seems that in rsyslogd-2039 the number is the error number. I cannot find where this is documented. You have already found the right answer, to use an alternative field, but for completeness here is how to truncate the programname at the first hyphen ("-"). You can use a property replacer to select field 1 where fields are delimited by the character with decimal code 45 (ascii hyphen).

 %programname:F,45:1%
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.