[syslog-ng] SQL destination - multiple destinations (tables) within one database ?

Gergely Nagy algernon at balabit.hu
Thu Apr 3 11:16:09 CEST 2014


Tomáš Novosad <tomas.novosad at linuxbox.cz> writes:

> i'd like to ask, if it si possible, somehow, to share one database connection
> across mutliple SQL destinations?
>
> Consider this setup (shortened):
>
> destination table_a { sql( type(psql) host("localhost")
> username("my_login") password("secret") database("my_db")
> table("table_a") columns(...) values (...) ); };
> destination table_b { sql( type(psql) host("localhost")
> username("my_login") password("secret") database("my_db")
> table("table_b") columns(...) values (...) ); };
> destination table_c { sql( type(psql) host("localhost")
> username("my_login") password("secret") database("my_db")
> table("table_c") columns(...) values (...) ); };
>
> when i'm using this setup, syslog open 3 separate connections to
> database, 1 connection for each destination.
>
> Is it possible to configure syslog-ng to use only 1 connection, as
> database and login are the same for all 3 destinations ?
>
> If there would be, let's say 50 different tables in single DB, there
> would be 50 separate connections, which is a waste of resources, as Postgres
> assign memory for each connection.

destination d_sql {
 sql(
   type(psql)
   host("localhost")
   username("my_login")
   password("secret")
   database("my_db")
   table("table_${my_table}")
   columns(...)
   values(...)
 );
};

Then you need a rewrite rule or something similar to set ${my_table},
use this same destination in multiple log paths, and voila! The only
restriction here is that columns must be the same accross all tables, as
that cannot contain templates (values() obviously can).

-- 
|8]



More information about the syslog-ng mailing list