My syslogd man page says that the pipe symbol before the file name means writing to a named pipe, not executing a command. You could attach a Perl process to the other side of the named pipe. You could even run the Perl script like this and still read from stdin: