I'm working on a logging system for OpenBSD's PF that reads from the pflog interface via tcpdump and writes to MySQL. Everything works fine, except... when a "flush state" or "flush all" command is sent, it appears to reset the interface, causing tcpdump to die and the while loop to close and end the script. Is there a good way of re-opening the filehandle once it's closed and re-starting the loop?
Here's a very simplified version:
#!/usr/bin/perl
use strict;
use DBI;
my $dbh = DBI->connect_cached($dsn, $user, $pass);
my $insert_stmt = "insert statement";
my $sth = $dbh->prepare($insert_stmt);
open(IN, "tcpdump -nelttti pflog0 2>&1 |");
while (<IN>) {
$sth->execute($stuff);
}
close(IN);
I guess it would be nice to put the loop inside its own sub (it's currently in the main flow), and then run some sort of true/false test on the state of <IN> from the filehandle. Any suggestions?
TIA,
-fp