fuzzyping has asked for the wisdom of the Perl Monks concerning the following question:

I'm working on a logging system for OpenBSD's PF that reads from the pflog interface via tcpdump and writes to MySQL. Everything works fine, except... when a "flush state" or "flush all" command is sent, it appears to reset the interface, causing tcpdump to die and the while loop to close and end the script. Is there a good way of re-opening the filehandle once it's closed and re-starting the loop?

Here's a very simplified version:
#!/usr/bin/perl

use strict;
use DBI;

my $dbh = DBI->connect_cached($dsn, $user, $pass);
my $insert_stmt = "insert statement";
my $sth = $dbh->prepare($insert_stmt);

open(IN, "tcpdump -nelttti pflog0 2>&1 |");
while (<IN>) {
   $sth->execute($stuff);
}
close(IN);

[download]
I guess it would be nice to put the loop inside its own sub (it's currently in the main flow), and then run some sort of true/false test on the state of <IN> from the filehandle. Any suggestions?

TIA,
-fp

Replies are listed 'Best First'.
Re: Keeping a loop alive
by Aristotle (Chancellor) on May 31, 2003 at 15:18 UTC
    So you want an infinite loop? Then just use one: 
    while(1) {
    open(IN, "tcpdump -nelttti pflog0 2>&1 |");
    while (<IN>) {
       $sth->execute($stuff);
    }
    close(IN);
}

    [download]

    Makeshifts last the longest.

[reply]
[d/l]
      Nope, doesn't work. As soon as tcpdump dies, the rest of it closes gracefully. Perhaps I'm overcomplicating matters, but would it help to fork() the process, then monitor the status of the child? Doesn't seem as though that would be theoretically any different than doing the "while (1)" loop.

      -fp

      Update: Minor correction. If I manually kill tcpdump, the loop does successfully start a new tcpdump process. It's only when I flush the states, and my ssh connection is closed, that it appears to kill off everything. I'm starting to wonder if it isn't a problem with a controlling terminal?
[reply]
        What is the "the rest of it", and of what is this rest?

        Makeshifts last the longest.

[reply]

Back to Seekers of Perl Wisdom