From 45900dd550e0aca724a4ec66c2833de3d27565e1 Mon Sep 17 00:00:00 2001 From: alakatos Date: Mon, 31 Oct 2022 14:40:12 +0100 Subject: [PATCH] [backport] imjournal: add second fallback to _COMM If SYSLOG_IDENTIFIER is not present in the journal message, then lookup the _COMM field, which stands for the name of the process the journal entry originates from. This is needed in order to be in compliance with the journalctl output. --- Conflict:NA Type:bugfix Reference:https://github.com/rsyslog/rsyslog/commit/fb5ae30e6ac4dc584dd9c5463e27e7fc5e9060a4 --- --- plugins/imjournal/imjournal.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c index 6fb3b7a07..4d9e59966 100644 --- a/plugins/imjournal/imjournal.c +++ b/plugins/imjournal/imjournal.c @@ -453,6 +453,8 @@ readjournal(void) /* Get message identifier, client pid and add ':' */ if (journalGetData("SYSLOG_IDENTIFIER", &get, &length) >= 0) { CHKiRet(sanitizeValue(((const char *)get) + 18, length - 18, &sys_iden)); + } else if (journalGetData("_COMM", &get, &length) >= 0) { + CHKiRet(sanitizeValue(((const char *)get) + 6, length - 6, &sys_iden)); } else { CHKmalloc(sys_iden = strdup("journal")); } -- 2.12.3