How does Tracking Center aggregate logs for a transaction?

[stevewilwerding]

When I look at the logs in Tracking Center, they are arranged by Time, From, and To, and if I expand one of them, I can see the entire transaction:



We are sending our logs to a log aggregation server, and would like to replicate that "grouping", but I'm not sure how. From what I can see, there are at least 4 IDs for this transaction: 243875 (which is internal and not in output logs), 717C92810AD, 2810F164639AA97ECEC, and 882CD2810FD. How does the Tracking Center know to aggregate all of these lines into one transaction?

 

[stevewilwerding]

Or, perhaps, is there a way to change the output so that it writes the From address on the status line (second to last line in my screenshot)?

 

[Stoiko Ivanov]

How does the Tracking Center know to aggregate all of these lines into one transaction?

By parsing and grouping the logs (parsing syslogs is quite a pita) - but what you could use is the `pmg-log-tracker` binary (which does the parsing and grouping - and send its output to your aggregation service.

For the details of the aggregation I'd refer you to the log-tracker source-code:
https://git.proxmox.com/?p=pmg-log-tracker.git;a=summary

I hope this helps!