[syslog-ng] SQL destination - multiple destinations (tables) within one database ?

[Tomáš Novosad]

Well, this is exactly the case - every table is diferent (different
columns), so i can not use this approach.

I have a table for raw maillog: time, host, message
and another table for parsed info: mail_id,from, to, relay, relay IP, ...
and another table for mailfilter info: mail_id,subject,spam score, antivir status, ...

In fact, i could do some magic in the postgres, where a would have some
RULES on inserts, which would pick the relevant columns from all the
input. But i think this is a bit brute-force solution, and i my case (3
different tables-3 connections) it would be rather a complication than
benefit.

I was hoping for something like i'v mentioned in original post.
At first declare a DB handle (driver,host, login, password, ...) in
syslog-ng.conf, and then use that handle in multiple destinations definition.
My opinion is that this would save a lot of system resources (on
postgres connections) and pretty
simplified the configuration in syslog-ng.conf.

Should i submit this idea on a wish list (if there is any sych thing for
syslog-ng)?


Thank You for info and wish You a nice day
-- 
Tomáš Novosad
LinuxBox.cz, s.r.o.
28. října 168, 709 00 Ostrava

tel.:   +420 591 166 221
mobil:  +420 737 238 655
email:  tomas.novosad at linuxbox.cz
jabber: novosad at linuxbox.cz
www.linuxbox.cz

mobil servis: +420 737 238 656
email servis: servis at linuxbox.cz

On  3. 4. 11:16, Gergely Nagy wrote:
> Tomáš Novosad <tomas.novosad at linuxbox.cz> writes:
> 
> > i'd like to ask, if it si possible, somehow, to share one database connection
> > across mutliple SQL destinations?
> >
> > Consider this setup (shortened):
> >
> > destination table_a { sql( type(psql) host("localhost")
> > username("my_login") password("secret") database("my_db")
> > table("table_a") columns(...) values (...) ); };
> > destination table_b { sql( type(psql) host("localhost")
> > username("my_login") password("secret") database("my_db")
> > table("table_b") columns(...) values (...) ); };
> > destination table_c { sql( type(psql) host("localhost")
> > username("my_login") password("secret") database("my_db")
> > table("table_c") columns(...) values (...) ); };
> >
> > when i'm using this setup, syslog open 3 separate connections to
> > database, 1 connection for each destination.
> >
> > Is it possible to configure syslog-ng to use only 1 connection, as
> > database and login are the same for all 3 destinations ?
> >
> > If there would be, let's say 50 different tables in single DB, there
> > would be 50 separate connections, which is a waste of resources, as Postgres
> > assign memory for each connection.
> 
> destination d_sql {
>  sql(
>    type(psql)
>    host("localhost")
>    username("my_login")
>    password("secret")
>    database("my_db")
>    table("table_${my_table}")
>    columns(...)
>    values(...)
>  );
> };
> 
> Then you need a rewrite rule or something similar to set ${my_table},
> use this same destination in multiple log paths, and voila! The only
> restriction here is that columns must be the same accross all tables, as
> that cannot contain templates (values() obviously can).
> 
> -- 
> |8]
> 
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
> 
>