39 lines
1.2 KiB
Diff
39 lines
1.2 KiB
Diff
From 45900dd550e0aca724a4ec66c2833de3d27565e1 Mon Sep 17 00:00:00 2001
|
|
From: alakatos <alakatos@redhat.com>
|
|
Date: Mon, 31 Oct 2022 14:40:12 +0100
|
|
Subject: [PATCH] [backport] imjournal: add second fallback to _COMM
|
|
|
|
If SYSLOG_IDENTIFIER is not present in the journal message,
|
|
then lookup the _COMM field, which stands for the name
|
|
of the process the journal entry originates from. This is
|
|
needed in order to be in compliance with the journalctl
|
|
output.
|
|
|
|
---
|
|
|
|
Conflict:NA
|
|
Type:bugfix
|
|
Reference:https://github.com/rsyslog/rsyslog/commit/fb5ae30e6ac4dc584dd9c5463e27e7fc5e9060a4
|
|
|
|
---
|
|
---
|
|
plugins/imjournal/imjournal.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c
|
|
index 6fb3b7a07..4d9e59966 100644
|
|
--- a/plugins/imjournal/imjournal.c
|
|
+++ b/plugins/imjournal/imjournal.c
|
|
@@ -453,6 +453,8 @@ readjournal(void)
|
|
/* Get message identifier, client pid and add ':' */
|
|
if (journalGetData("SYSLOG_IDENTIFIER", &get, &length) >= 0) {
|
|
CHKiRet(sanitizeValue(((const char *)get) + 18, length - 18, &sys_iden));
|
|
+ } else if (journalGetData("_COMM", &get, &length) >= 0) {
|
|
+ CHKiRet(sanitizeValue(((const char *)get) + 6, length - 6, &sys_iden));
|
|
} else {
|
|
CHKmalloc(sys_iden = strdup("journal"));
|
|
}
|
|
--
|
|
2.12.3
|
|
|