From 9d6fc6eca2aba98fe9ecbe5bddf61e6ead572309 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Wed, 16 Apr 2014 23:58:00 +0100
Subject: [PATCH] ENH: For syslog use SYSLOG_PID over _PID in systemd journal
 log format

---
 fail2ban/server/filtersystemd.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fail2ban/server/filtersystemd.py b/fail2ban/server/filtersystemd.py
index c6d0efd1..7ab56039 100644
--- a/fail2ban/server/filtersystemd.py
+++ b/fail2ban/server/filtersystemd.py
@@ -167,8 +167,9 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
 			logelements.append(logentry['_HOSTNAME'])
 		if logentry.get('SYSLOG_IDENTIFIER'):
 			logelements.append(logentry['SYSLOG_IDENTIFIER'])
-			if logentry.get('_PID'):
-				logelements[-1] += ("[%i]" % logentry['_PID'])
+			if logentry.get('SYSLOG_PID') or logentry.get('_PID'):
+				logelements[-1] += ("[%i]" % logentry.get(
+					'SYSLOG_PID', logentry['_PID']))
 			logelements[-1] += ":"
 		elif logentry.get('_COMM'):
 			logelements.append(logentry['_COMM'])