Tukukkk

Hello StackOverflow Gods/Regulars/Users !

I am currently working on a logging system for two applications running on my servers.

Here is the context :

• Server dev1 : Ubuntu server 18.04 (freshly installed)
  
  
  
  
  • is running a systemd.service algo-ep
  
  
  
  

    [Unit]

    Description="Algo EP"

    [Service]

    Type=simple

    User=me

    WorkingDirectory=/home/me/bin

    ExecStart=/home/me/bin/AlgoEp

    StandardOutput=syslog

    StandardError=syslog

    SyslogIdentifier=dev1_algo_ep

    [Install]

    WantedBy=multi-user.target

• is running another systemd.service algo-mdw

    [Unit]

    Description="Algo MDW"

    [Service]

    Type=simple

    User=me

    WorkingDirectory=/home/me/bin

    ExecStart=/home/me/bin/AlgoMdw

    StandardOutput=syslog

    StandardError=syslog

    SyslogIdentifier=dev1_algo_mdw

    [Install]

    WantedBy=multi-user.target

• Server dev2 : Ubuntu server 18.04 (freshly installed)
  
  
  
  
  • is running a systemd.service algo-ep
  
  
  
  

    [Unit]

    Description="Algo EP"

    [Service]

    Type=simple

    User=me

    WorkingDirectory=/home/me/bin

    ExecStart=/home/me/bin/AlgoEp

    StandardOutput=syslog

    StandardError=syslog

    SyslogIdentifier=dev2_algo_ep

    [Install]

    WantedBy=multi-user.target

I wanted to be able to read the log of each service when I ssh on dev1 using journalctl (systemd-journal).

Like this:journalctl -t dev1_algo_ep -t dev1_algo_mdw -t dev2_algo_ep

So, I added a rsyslog.d/algo-ep.conf on dev2:

if $programname == 'dev2_algo_ep' then {          

        action(type="omfwd"                       

           queue.type="linkedlist"                

           queue.filename="algo_fwd"              

           queue.saveOnShutdown="on"              

           action.resumeRetryCount="-1"           

           target="dev1" port="514" protocol="tcp"

        )

}

and added rsyslog.d/algo.conf on dev1:

module(load="imtcp")

module(load="omjournal")



ruleset(name="remote-dev2") {

        action(type="omjournal")

}



input(type="imtcp" port="514" ruleset="remote-dev2")

At this point, no problem, I got the line in journalctl with journalctl -r:

Nov 23 13:27:47 dev1 dev2_algo_ep[3142]:[15246]:  Ep Server listening on localhost:10001...

Nov 23 13:27:47 dev1 dev2_algo_ep[2421]:[15246]:  Ep Server stops...

[...]

But when I try journalctl -t dev2_algo_ep:

me@dev1:~$ journalctl -t dev2_algo_ep

-- Logs begin at Fri 2018-06-01 13:54:11 CEST, end at Fri 2018-11-23 13:27:47 CET. --

me@dev1:~$

Because received log's SYSLOG_IDENTIFIER is set as dev2_algo_ep[3142]: instead of dev2_algo_ep.

So, my question : Is there a way, magical or obvious

1. to export the log from dev2 to dev1 with a specific SYSLOG_IDENTIFIER ?


2. or to receive the log on dev1 and to set a specific SYSLOG_IDENTIFIER before sending it to journald ?


3. or simply to do this ?

Thanks in advance for your advice, your help and your information !

[Edit]
It seems that the mix rsyslog + journald is very little known. I didn't found anything in the man page (except the possibility to create a template to rebuild the log at reception on dev1, but looks pretty odd to me).