From 45900dd550e0aca724a4ec66c2833de3d27565e1 Mon Sep 17 00:00:00 2001
From: alakatos <alakatos@redhat.com>
Date: Mon, 31 Oct 2022 14:40:12 +0100
Subject: [PATCH] [backport] imjournal: add second fallback to _COMM

If SYSLOG_IDENTIFIER is not present in the journal message,
then lookup the _COMM field, which stands for the name
of the process the journal entry originates from. This is
needed in order to be in compliance with the journalctl
output.

---

Conflict:NA
Type:bugfix
Reference:https://github.com/rsyslog/rsyslog/commit/fb5ae30e6ac4dc584dd9c5463e27e7fc5e9060a4

---
---
 plugins/imjournal/imjournal.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c
index 6fb3b7a07..4d9e59966 100644
--- a/plugins/imjournal/imjournal.c
+++ b/plugins/imjournal/imjournal.c
@@ -453,6 +453,8 @@ readjournal(void)
 	/* Get message identifier, client pid and add ':' */
 	if (journalGetData("SYSLOG_IDENTIFIER", &get, &length) >= 0) {
 		CHKiRet(sanitizeValue(((const char *)get) + 18, length - 18, &sys_iden));
+	} else if (journalGetData("_COMM", &get, &length) >= 0) {
+		CHKiRet(sanitizeValue(((const char *)get) + 6, length - 6, &sys_iden));
 	} else {
 		CHKmalloc(sys_iden = strdup("journal"));
 	}
-- 
2.12.3