Subject: Re: 9.5 new setting "cluster name" and logging
To: Fujii Masao <masao.fujii@gmail.com>
References: <1377186808.57546.YahooMailNeo@web193505.mail.sg3.yahoo.com>
 <A737B7A37273E048B164557ADEF4A58B17C08086@ntex2010a.host.magwien.gv.at>
 <1377494614.9111.YahooMailNeo@web193506.mail.sg3.yahoo.com>
 <A737B7A37273E048B164557ADEF4A58B17C0876C@ntex2010a.host.magwien.gv.at>
 <56AC5601.5040208@uvic.ca> <20160218214202.GA30326@momjian.us>
 <27145.1455832381@sss.pgh.pa.us> <56C64017.7050303@uvic.ca>
 <CAHGQGwF1q05ot5hd-Cn+sd0nz7iuqjA+GKz2ZmZb-JURd_TZmA@mail.gmail.com>
Cc: "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
From: Evan Rempel <erempel@uvic.ca>
Message-ID: <56C73A39.7010609@uvic.ca>
Date: Fri, 19 Feb 2016 07:52:25 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.4.0
MIME-Version: 1.0
In-Reply-To: 
 <CAHGQGwF1q05ot5hd-Cn+sd0nz7iuqjA+GKz2ZmZb-JURd_TZmA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

On 02/19/2016 05:56 AM, Fujii Masao wrote:
> On Fri, Feb 19, 2016 at 7:05 AM, Evan Rempel <erempel@uvic.ca> wrote:
>> On 02/18/2016 01:53 PM, Tom Lane wrote:
>>> Bruce Momjian <bruce@momjian.us> writes:
>>>> On Fri, Jan 29, 2016 at 10:19:45PM -0800, Evan Rempel wrote:
>>>>> Now that there is a setting to give a cluster a "name", it would be
>>>>> nice to have an escape sequence in the log_line_prefix setting that
>>>>> could reference the cluster_name.
>>>> Uh, wouldn't the cluster name be the same on every line?  Is that
>>>> useful?
>>> I guess if you were running multiple clusters and having them all log
>>> to the same syslog daemon, there might be multiple clusters' output
>>> in the same log ... but we already have ways to disambiguate that case,
>>> ie, syslog_ident.  Likewise for Windows' event log.  I don't think we
>>> should consider it supported for multiple clusters to be logging into
>>> the same plain files.  So yeah, the use case for this seems unclear.
>>>
>>>                          regards, tom lane
>>
>> The use case is for logging to syslog.
>>
>> Using the syslog_ident effectively changes the "program name" to something
>> other than postgres. This would break any type of SIEM system that would be
>> looking for events from the program postgres. This means that if you want to
>> have a cluster specific contextual identifier, it needs to be in the log
>> message content, which for the purposes of postgresql means placing it into
>> the log_line_prefix.
>>
>> It could be hard coded as part of the log_line_prefix such as
>>
>> log_line_prefix = 'cluster-db1:%d:%u:%h '
>>
>> That would work, but that means that my cluster name needs to be in the
>> configuration file twice and that opens up the error scenario of not making
>> them exactly the same.
>>
>> Allowing for the cluster_name to be referenced by an escape sequence would
>> make manual and automated configuration management easier.
> What if log_destination is set to csvlog? The same cluster_name is
> output in every lines, and there is no way to disable it because
> something like csv_line_prefix has not been supported yet?
>
> Regards,
>

I would think that in the case of using a csvlog that you would configure the log_line_prefix to not include the escape sequence of the cluster_name. The administrator would tune all of the logging components to work together, or am I missing something here?

-- 
Evan Rempel


-- 
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin