Re:Process ID

Actually RFC3164 doesn't consider the PID as a special field of the syslog 
message.

The TAG part that is the part that actually contain the program name, is 
defined as a string of alphanumeric chars that cannot exceed 32 characters.

Quoting RFC :

"The TAG is a string of
   ABNF alphanumeric characters that MUST NOT exceed 32 characters.  Any
   non-alphanumeric character will terminate the TAG field and will be
   assumed to be the starting character of the CONTENT field."

So a message like "Dec 12 11:11:11 hostname programname[1234]: message", will 
have the TAG field set to "programname" and the CONTENT field set to "[1234]: 
message"

If you want to retrieve the PID you have to parse on your own the content part.

It's not syslog-ng configuration matter, if there is a PID displayed or not in 
the message, and again, PID is not part of the RFC3164.

Hope it will help.

Amodiovalerio [Hypo] Verde

---------- Initial Header -----------

>From      : syslog-ng-admin@xxxxxxxxxxxxxxxx
To          : syslog-ng@xxxxxxxxxxxxxxxx
Cc          :
Date      : Sun, 28 Mar 2004 09:42:38 +0200
Subject : [syslog-ng]Process ID

> Hello,
>
> I am a new-comer to syslog-ng, and there one configuration issue that I was 
> unable to
> resolve, and did not see any reference to it in the internet:
> How can I configure syslog-ng to display the PID of the program (that submits 
> the syslog command)?
>
> Thanks,
> Menny
>  
>

_______________________________________________
syslog-ng maillist  -  syslog-ng@xxxxxxxxxxxxxxxx
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html