Outputting syslog to some perl code

Binford has asked for the wisdom of the Perl Monks concerning the following question:

I am trying to output some log messages from some perl code (specifically local4.* messages to a perl script). Frankly i thought this was fairly trivial, but my script doesn't seem to receive the data. here's what my syslog.conf line looks like:

local4.* | /home/code/perlscript

Here's the code I *THOUGHT* would work (simplified greatly for this question):

#!/usr/bin/perl -w

while (<>) {
open (LDAPOUT, ">>/home/code/writtenbyperllog");    
    print LDAPOUT $_;
close LDAPOUT;
}
[download]

Since syslogd (5) says it should pipe to a command as STDIN, but it don't. I've tested script by:

$ echo "gobbledygook" | ./perlscript

and it works fine so I am assuming it's something I don't know about syslog output somewhere. I've tried every google search I can think for some examples but haven't found anything. Thanks! Binford

Comment on Outputting syslog to some perl code Download Code

Replies are listed 'Best First'.
Re: Outputting syslog to some perl code by iburrell (Chaplain) on Nov 06, 2002 at 02:07 UTC
My syslogd man page says that the pipe symbol before the file name means writing to a named pipe, not executing a command. You could attach a Perl process to the other side of the named pipe. You could even run the Perl script like this and still read from stdin: `./perlscript < /tmp/log-named-pipe` [download]	[reply] [d/l]
Re: Outputting syslog to some perl code by sauoq (Abbot) on Nov 06, 2002 at 02:11 UTC
Are you sure you read the manpage for the system that you are actually working on? Many unices differ in this area. Solaris doesn't even allow the syntax, I don't think. Linux usually uses it to mean "write to a named pipe." On IRIX, such a command acts as a filter and must be followed by another action. Some BSDs behave as you describe. If your system definitely permits the behavior you want, it might be a permissions issue. If syslogd runs the command specified as a user that doesn't have permission to run your script or to write to your `/home/code/writtenbyperllog` file. It might even be a formatting issue; some syslogd.conf files must have tab delimited fields. It isn't is a Perl issue though. The code is fine. But you already knew that... Good luck. -sauoq "My two cents aren't worth a dime.";	[reply] [d/l]
Re: Outputting syslog to some perl code by graff (Chancellor) on Nov 06, 2002 at 04:07 UTC
Sorry, I'm not familiar with the situation you're describing, which probably explains why I have this question: Why do you have the "open()" and "close()" inside the while loop, rather than outside?	[reply]
Re: Re: Outputting syslog to some perl code by Binford (Sexton) on Nov 06, 2002 at 17:28 UTC
Technically I wouldn't normally have the open and close inside the loop, it was there as one of the last things I tried (thinking on the off chance that it might be something funky with the IO coming from syslog). I took the LINUX syslog(5) manpage to mean you could pipe the logdata to a normal command and then do what you would with the data. I am trying to parse the openldap log files for failed authentication messages and based on that re-write the data to a IPTABLES format to stop any attempts to access a given IP until authentication is correct. I've got some failry complex (for me anyway) regex writtenm inside that loop to parse the log data, but have gotten stuck with this whole syslog issue. Based on your replies, I think my knowledge is lacking in the area of "named pipes" as opposed to pipes as I understood them. SO, I guess this isn't really a perl issue at this point, but I am stumped as to where go look for resolution. I guss I will go back to logging to a file and then use perl's IO::Handle functions to continaully monitor the trailing end of said file. I just thought it ould be more elegant to send the data directly to my program, doe my processing on it and write the log file out from within POST processing. Binford	[reply]