Hello Monks!
I am trying to batch process syslogs from multiple firewalls in very close to realtime using File::Tail::Multi. Each device writes to its own syslog file, thus my need to have some form of multiple tails.
The code is pretty straight forward in the example, but no matter what I push (in terms of syslog) into it, I get errors like this on each and every line:
Invalid conversion in printf: "%P" at ./systail line 89, <GEN0> line 6
+68899.
Line 89 in my proto-code is a simple:
printf("$line\n");
The error is actually attached to the line, so it gets passed into the rest of the processing and pretty much wreaks havoc with my regex's etc.
Here is a snippet of what I am working with (I changed the actual processing to a simple printf while I am troubleshooting):
### Set up the multitail handle for our logfiles
$multitail=File::Tail::Multi->new
(
Files => ["$logstring"],
Debug => "0",
Function => \&ProcessLogs,
RemoveDuplicate => 0,
);
for (;;)
{
$multitail->read;
sleep 4;
}
exit 0;
### Log Processing Main Routine
sub ProcessLogs
{
my $passed=shift;
foreach my $line ( @{$passed} )
{
chomp $line;
printf("$line\n");
next if $line=~//;
if ($line=~/Built/) { printf("Built\n"); }
elsif ($line=~/Teardown/) { printf("Teardown\n"); }
elsif ($line=~/Deny/) { printf("Deny\n"); }
}
}
Does anyone have any experience with tailing multiple files, or has used File::Tail::Multi that can offer some sage-like wisdom? This seems pretty straight forward, but after commenting out the "next if" line and rewriting this a few different ways, I am kind of lost here.
Thank you!