Re: 9.5 new setting "cluster name" and logging - Mailing list pgsql-admin

On Sat, Feb 20, 2016 at 1:19 AM, Evan Rempel <erempel@uvic.ca> wrote:
> On 02/19/2016 08:10 AM, Fujii Masao wrote:
>>
>> On Sat, Feb 20, 2016 at 12:52 AM, Evan Rempel <erempel@uvic.ca> wrote:
>>>
>>> On 02/19/2016 05:56 AM, Fujii Masao wrote:
>>>>
>>>> On Fri, Feb 19, 2016 at 7:05 AM, Evan Rempel <erempel@uvic.ca> wrote:
>>>>>
>>>>> On 02/18/2016 01:53 PM, Tom Lane wrote:
>>>>>>
>>>>>> Bruce Momjian <bruce@momjian.us> writes:
>>>>>>>
>>>>>>> On Fri, Jan 29, 2016 at 10:19:45PM -0800, Evan Rempel wrote:
>>>>>>>>
>>>>>>>> Now that there is a setting to give a cluster a "name", it would be
>>>>>>>> nice to have an escape sequence in the log_line_prefix setting that
>>>>>>>> could reference the cluster_name.
>>>>>>>
>>>>>>> Uh, wouldn't the cluster name be the same on every line?  Is that
>>>>>>> useful?
>>>>>>
>>>>>> I guess if you were running multiple clusters and having them all log
>>>>>> to the same syslog daemon, there might be multiple clusters' output
>>>>>> in the same log ... but we already have ways to disambiguate that
>>>>>> case,
>>>>>> ie, syslog_ident.  Likewise for Windows' event log.  I don't think we
>>>>>> should consider it supported for multiple clusters to be logging into
>>>>>> the same plain files.  So yeah, the use case for this seems unclear.
>>>>>>
>>>>>>                           regards, tom lane
>>>>>
>>>>>
>>>>> The use case is for logging to syslog.
>>>>>
>>>>> Using the syslog_ident effectively changes the "program name" to
>>>>> something
>>>>> other than postgres. This would break any type of SIEM system that
>>>>> would
>>>>> be
>>>>> looking for events from the program postgres. This means that if you
>>>>> want
>>>>> to
>>>>> have a cluster specific contextual identifier, it needs to be in the
>>>>> log
>>>>> message content, which for the purposes of postgresql means placing it
>>>>> into
>>>>> the log_line_prefix.
>>>>>
>>>>> It could be hard coded as part of the log_line_prefix such as
>>>>>
>>>>> log_line_prefix = 'cluster-db1:%d:%u:%h '
>>>>>
>>>>> That would work, but that means that my cluster name needs to be in the
>>>>> configuration file twice and that opens up the error scenario of not
>>>>> making
>>>>> them exactly the same.
>>>>>
>>>>> Allowing for the cluster_name to be referenced by an escape sequence
>>>>> would
>>>>> make manual and automated configuration management easier.
>>>>
>>>> What if log_destination is set to csvlog? The same cluster_name is
>>>> output in every lines, and there is no way to disable it because
>>>> something like csv_line_prefix has not been supported yet?
>>>>
>>>> Regards,
>>>>
>>> I would think that in the case of using a csvlog that you would configure
>>> the log_line_prefix to not include the escape sequence of the
>>> cluster_name.
>>> The administrator would tune all of the logging components to work
>>> together,
>>> or am I missing something here?
>>
>> log_line_prefix is only for stderr and syslog, not for csvlog.
>> It cannot control what to output in csvlog, for now.
>>
>> Regards,
>
>
> In that case, my request for a new escape sequence for the log_line_prefix
> will have no impact on csvlog output because it would
> only affect uses cases where log_line_prefix is used AND where the
> administrator has added the cluster name into the log_line_prefix.

So cluster_name will never appear in csvlog. Maybe I'm OK with that.

OTOH, there are many "escape sequences" available in log_line_prefix,
and their corresponding information is basically output in csvlog,
but only cluster_name is not. That design looks a bit odd.

Regards,

--
Fujii Masao