The concept seems sound. You don't need an exec() because you aren't passing control to any other programs. You might want to use qr to compile your regular expression once instead of every single time.

I think you need to re-evaluate what you are doing in your while loop. If either of those regular expressions match, you'll have an infinite loop. It doesn't look like you ever are updating the value of $logline unless there is some magic in File::ReadBackwards that I'm not understanding.

Although it might not be a good fit for you in this case, I recommend reading about Parallel::ForkManager. It is so very simple to use and is often a great choice whenever you are trying to speed up a job by running it in parallel.

I think there is a larger issue here, and that is the current approach you are taking could seriously impact the resources on the system you run it on. If you fork once for each file you are trying to monitor, and you truly end up monitoring in excess of 120 such files, you will run into overhead problems.

As a first step, I would recommend that you structure the program around the regular polling of the files for actual changes in the modification time. If all you do is continually look at the last line every n minutes, do you sent multiple mail alerts for the same line merely because there hasn't been a new line in the last n + 1 minutes?

Secondly, the only real need for forking is to prevent the sending of mail from stopping the main program from continuing. To this end, once you have a truly new line of output from one of the logs, check it against the pattern within the main program. If it warrants an e-mail alert, have the subroutine that sends the alert do the forking. Plus, there is no need for sleeping after the mail (unless this was part of the original design to wait a certain period before polling the logfile again). If the forked child process is only responsible for sending the e-mail, it can use exec() rather than system(). You will also want to do something with the CHLD signal in the parent process.

Getting back to the main point, I don't think you really want a one-to-one mapping of process-to-logfile, unless the machine running these processes is dedicated to just those tasks. This isn't a trivial task, especially not with the number of files you expect to be monitoring simultaneously. It is well worth the effort of taking some time to plan it through, and carefully.

--rjray

But your method doesn't eliminate the possibility of missing lines. You still have a race condition. What if your log got 20 lines apppended to it during that 60 second sleep? You'd only see the last line.

It sounds to me like you want to try to emulate 'tail -f' on your log files and then continuously cycle through them (perhaps in a multi-threaded fashion) looking for updates. I agree with the previous poster, though that a one to one relationship between processes and log files isn't such a good idea. I would suggest building a system where the number of children is configurable, and they all share the job of scanning your logs. Each time a child comes to a log it would need to pick up on the filehandle where it left off and scan till it gets to the end, then move on to whatever log it should do next.

#!/usr/bin/perl -w
#
use strict;
use Parallel::ForkManager;
use File::ReadBackwards;
#
my (@DBLOG,@SKIPCODES,$logline,$line,$list,$node,$pm,$i);
#
@DBLOG=qw( /bd01/systems/systems.lg /ad04/orders/orders.lg /bd02/maste
+r/master.lg /cd01/billing/billing.lg /cd02/audit/audit.lg /bd01/custo
+m/custom.lg /bd01/apprules/apprules.lg );
#
@SKIPCODES=qw( lots of inconsequential stuff that I want to ignore );

$list = join ("|", map {quotemeta} @SKIPCODES);

$node=`uname -n`;

$pm=new Parallel::ForkManager(7);

foreach ($i)
 {
   my $pid=$pm->start and next;
     while (1==1)
      {
        $line = File::ReadBackwards->new( $i ) || die "Can't read from
+ $i:$!";
        $logline = $line->readline;
        next if $logline =~ /\W$list\W/;
        next if $logline =~ /^$/;
        system ("echo \"There is a problem with database logfile: \"$i
+\" on $node\.  Here is the error\:\n\n $logline\" | mailx -s \"PROGRE
+SS DATABASE PROBLEM!!!\" psmith\@xxxxx\.com");
        system ("sleep 120");
      }
  }
[download]