Re: 9.5 new setting "cluster name" and logging

On 02/18/2016 01:53 PM, Tom Lane wrote:
> Bruce Momjian <bruce(at)momjian(dot)us> writes:
>> On Fri, Jan 29, 2016 at 10:19:45PM -0800, Evan Rempel wrote:
>>> Now that there is a setting to give a cluster a "name", it would be
>>> nice to have an escape sequence in the log_line_prefix setting that
>>> could reference the cluster_name.
>> Uh, wouldn't the cluster name be the same on every line? Is that
>> useful?
> I guess if you were running multiple clusters and having them all log
> to the same syslog daemon, there might be multiple clusters' output
> in the same log ... but we already have ways to disambiguate that case,
> ie, syslog_ident. Likewise for Windows' event log. I don't think we
> should consider it supported for multiple clusters to be logging into
> the same plain files. So yeah, the use case for this seems unclear.
>
> regards, tom lane

The use case is for logging to syslog.

Using the syslog_ident effectively changes the "program name" to something other than postgres. This would break any type of SIEM system that would be looking for events from the program postgres. This means that if you want to have a cluster specific contextual identifier, it needs to be in the log message content, which for the purposes of postgresql means placing it into the log_line_prefix.

It could be hard coded as part of the log_line_prefix such as

log_line_prefix = 'cluster-db1:%d:%u:%h '

That would work, but that means that my cluster name needs to be in the configuration file twice and that opens up the error scenario of not making them exactly the same.

Allowing for the cluster_name to be referenced by an escape sequence would make manual and automated configuration management easier.

Thanks for listening.

--
Evan Rempel