my %logs_to_watch =
  ( cron => "/var/log/cron",
    mail  => "/var/log/maillog",
    ppp   => "/var/log/ppp.log",
    httpd => "/var/log/httpd-access.log",
    msg   => "/var/log/messages",
  );

# Start a session to watch the logs.

POE::Session->create
  ( inline_states =>
      { _start => \&begin_watchers,

        # Handle records from each log differently.
        cron_record  => \&cron_got_record,
        mail_record  => \&mail_got_record,
        ppp_record   => \&ppp_got_record,
        httpd_record => \&httpd_got_record,
        msg_record   => \&msg_got_record,

        # Handle log resets and errors the same way for each file.
        log_reset => \&generic_log_reset,
        log_error => \&generic_log_error,
      }
  );


=for cookbook

Start log watchers.  Scans the hash of %logs_to_watch, creating a new
FollowTail wheel to watch each.

Each watcher emits an event based on its key in %logs_to_watch.  Those
events are handled by functions that will parse, filter, and if
necessary display information about the records.

For example, cron is the key for "/var/log/cron".  The cron log
watcher will emit a "cron_record" event whenever that file extends.
The POE::Session->create() call above associates the "cron_record"
event with the cron_got_record() function later on.

=cut

sub begin_watchers {
    my $heap = $_[HEAP];

    while ( my ( $service, $log_file ) = each %logs_to_watch ) {
        my $log_watcher = POE::Wheel::FollowTail->new
          ( Filename => $log_file,
            InputEvent => $service . "_record",
            ResetEvent => "log_reset",
            ErrorEvent => "log_error",
          );

        $heap->{services}->{ $log_watcher->ID } = $service;
        $heap->{watchers}->{ $log_watcher->ID } = $log_watcher;
    }
}
[download]