Syslog plugin Program name from rsyslog msg first word

[itkroplis]

Hi!

How is possible to make in Syslog Program column value from rsyslog msg first word?



Ubuntu server 20.04, PHP 7.4.3 (cli), Apache/2.4.41, 10.3.25-MariaDB-0ubuntu0.20.04.1
latest cacti +spine + rsyslog + syslog(3.2)

/etc/rsyslog.d/cacti.conf
$ModLoad imudp
$UDPServerRun 514
$ModLoad ommysql

$template cacti_syslog,"INSERT INTO syslog_incoming(facility_id, priority_id, program, logtime, host, message) \
values (%syslogfacility%, %syslogpriority%, '%programname%', '%timegenerated:::date-mysql%', '%HOSTNAME%', TRIM('%msg%'))", SQL

*.* >localhost,syslog,cactiuser,cactiuser;cacti_syslog

[cigamit]

You would have to edit the plugin code, the stuff you posted has nothing to do with the display

[itkroplis]

I was suspicious. Thinking of .php files? Where exactly are these rows? syslog.php others?

[itkroplis]

I test logsend with "Packet Sender" if in ASCII use
hostname commandlog msgmsgmsgmsmgsgmsmgsmgmsmgsmgmsgmsmgmsgmsmg
In Syslog UI I see correctly info by Device | Program | Message

But if I send log from Linux rsyslog host

/etc/rsyslog.d/commands.log.conf
----------------------------------------------------------------------
$ModLoad imfile #Load the imfile input module
$InputFilePollInterval 10
$InputFileName /var/log/commands.log
$InputFileTag commands.log
$InputFileStateFile commands.log
$InputFileSeverity Info
$InputFileFacility local7
$InputRunFileMonitor

$template commands, " commandlog %msg% "

if $programname == 'commands.log' then @10.10.10.46:514;commands
if $programname == 'commands.log' then stop
--------------------------------------------------------------------
I get " commandlog %msg% " any in Messages
commandlog Dec 26 20:45:50 gitlab : root [10393]: /etc/init.d/rsyslog restart [0]

It seems to me that cacti syslog worked differently with syslog-ng. Any ideas what needs to change?


Ok, I found such a solution:

$template commands, " %hostname% commandlog %msg% "
Is not an elegant solution but it works.