How can I change my syslog-ng template so that when the log originates from a systemd service / unit, the log message will include the unit's name?
Using ${PROGRAM}
just shows the name of the executable that the systemd service called / that the message originated from. journald seems to have a field for this information: _SYSTEMD_UNIT
, but referencing that in my syslog-ng template seems to be insufficient.
Background on my setup:
I'm running Debian Jessie and have created systemd services to manage Docker containers. The applications in these containers log to stdout / stderr, which subsequently ends up in log files controlled by journald.
I use syslog-ng (version 3.5.6-2) to forward my logs to loggly and papertrail (comparing them right now). Since I'm running Debian Jessie, I configured journald to forward log messages to syslog by setting ForwardToSyslog=yes
in journald.conf
.
Problem:
The default templates for loggly and papertrail include ${PROGRAM}
in each log message, which is the name of the 'executable' that generated the message. However, in my setup, the executable called is docker
for all of my containers. Thus, the name of the executable is useless for helping me filter logs and identify logs originating from specific containers.
Notes:
syslog-ng documentation notes that there is a systemd-journal
driver, which seems to provide additional variables. However, that driver doesn't seem to be available in Debian Jessie's version of syslog-ng (3.5.6-2)