On Fri, Jun 4, 2010 at 3:41 AM, Balazs Scheidler <bazsi@balabit.hu> wrote:

On Wed, 2010-06-02 at 17:09 +0200, Dragan Zubac wrote:

...

Hello

I'm using syslog-ng to log messages into PostgreSQL via file logging. I have a problem,because syslog-ng actually sends two messages from log file,instead one at a time. In attachment,You may see two messages that has the same ID number and were sent together,as 'one' message into database procedure. Is it possible to configure syslog-ng to send one message at a time only ?

I don't really understand your question. The messages you have marked in your original email use the same PID, but pids are in no way unique.

Perhaps postfix is sending a log message to syslog with a newline character in it - so syslog is printing it as two separate log lines in the file, but sending to postgres as one message? I don't understand the question either if this is not the case.

-- Bazsi

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

-- Lance Laursen Demonware Systems Engineer

On Mon, 2010-06-07 at 11:33 +0200, Dragan Zubac wrote:

Hello

It was my error,since I had a bug in regexp in a stored procedure in PostgreSQL,so the procedure was not processing particular message from syslog. By the way,is it possible for syslog-ng to call stored procedure directly,instead of logging into file and then another script picking up that data and storing them into database ? Basically,is it possible for a syslog-ng to do the following:

1. Got message,filter satisfied,it will call destination 'sql' for example. 2. destination 'sql' will connect to database,and do the following :

select * from syslog_procedure('$MSG');

instead of the classic way of insert:

insert into syslog_table (message) values ('$MSG');

not yet, but it's in my plans, something along the way: sql(.... values(string("$MSG"), expr("<sql expression>"))); e.g. you could enclose the value expression with a type specifier that'd tell syslog-ng how to interpret the expanded value. string: same as now, default expr: SQL expression, without enclosing the expanded string in quotes default: use the default value of the column -- Bazsi