Actually RFC3164 doesn't consider the PID as a special field of the syslog message. The TAG part that is the part that actually contain the program name, is defined as a string of alphanumeric chars that cannot exceed 32 characters. Quoting RFC : "The TAG is a string of ABNF alphanumeric characters that MUST NOT exceed 32 characters. Any non-alphanumeric character will terminate the TAG field and will be assumed to be the starting character of the CONTENT field." So a message like "Dec 12 11:11:11 hostname programname[1234]: message", will have the TAG field set to "programname" and the CONTENT field set to "[1234]: message" If you want to retrieve the PID you have to parse on your own the content part. It's not syslog-ng configuration matter, if there is a PID displayed or not in the message, and again, PID is not part of the RFC3164. Hope it will help. Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin@lists.balabit.hu To : syslog-ng@lists.balabit.hu Cc : Date : Sun, 28 Mar 2004 09:42:38 +0200 Subject : [syslog-ng]Process ID

Hello,

I am a new-comer to syslog-ng, and there one configuration issue that I was unable to resolve, and did not see any reference to it in the internet: How can I configure syslog-ng to display the PID of the program (that submits the syslog command)?

Thanks, Menny