Re: [Simple-evcorr-users] read/write operations through named pipe
Am I understanding correctly that you want to write some of the data
from named pipe to an external log? Since SEC is already reading from
the pipe, it's a bad idea to start another process that reads the same
pipe, since reading removes data from pipe.
If would recommend a separate rule that would match each SEC input
event and write to a separate file with write action. For example:
type=single
ptype=RegExp
pattern=.?
desc=write each input line to a separate file
action=write /var/log/sec-monitor.log $0
regards,
risto
2010/12/8 M Haris Farooque :
> hello guys,
> I have another question related to Named Pipe.
> I have made a "/usr/local/etc/SEC_Log_Pipe " and hang it with SEC so that
> SEC can read input text from it;
>
> cmd1: perl -w /usr/local/sbin/sec.pl --conf=xxx.cfg --conf=yyy.cfg
> --conf=zzz.cfg -input=/usr/local/etc/SEC_Log_Pipe -intevents
>
> I need to log some information also in a log file upon successful execution
> of one of my defined rule and i wanted to use the same pipe for writing it.
>
> I wrote the following script for writing;
>
> open(NAMEDPIPE, "+< $filename") or die "fifo $!";
> $| = 1;
>
> while ()
> {
> print $_;
> }
>
> and executed it as a background process like this;
> cmd2: perl sec_log_pipe.pl >> /var/log/sec_monitor.log &
>
> but 2 seperate processes are created. (lsof /usr/local/etc/SEC_Log_Pipe
> shows both processes). One processes is created by SEC i.e. for
> taking Input and another by for logging out data to a log file.
> Since, I always execute cmd2 after cmd1 so, logging is working fine, but SEC
> is not able to take any input unless I kill the process (cmd2).
>
> action statement in my rule set is;
> type=Single
> ptype=RegExp
> patter=blah,blah
> desc=$0
> action= write /usr/local/etc/SEC_Log_Pipe [%u] %s
>
> Is there a good way to handle read/write operations through named pipe?
> Thanks in advance,
> --
>
> Kind Reagrds/Mit freundlichen Grüßen
>
> M Haris Farooque
>
> --
> What happens now with your Lotus Notes apps - do you make another costly
> upgrade, or settle for being marooned without product support? Time to move
> off Lotus Notes and onto the cloud with Force.com, apps are easier to build,
> use, and manage than apps on traditional platforms. Sign up for the Lotus
> Notes Migration Kit to learn more. http://p.sf.net/sfu/salesforce-d2d
> ___
> Simple-evcorr-users mailing list
> Simple-evcorr-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
>
--
This SF Dev2Dev email is sponsored by:
WikiLeaks The End of the Free Internet
http://p.sf.net/sfu/therealnews-com
___
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
Re: [Simple-evcorr-users] read/write operations through named pipe
In message <4cffa586.70...@fleetboard.com>, M Haris Farooque writes: >I have another question related to Named Pipe. >I have made a "/usr/local/etc/SEC_Log_Pipe " and hang it with SEC so=20 >that SEC can read input text from it; > >*cmd1*: /perl -w /usr/local/sbin/sec.pl --conf=3Dxxx.cfg --conf=3Dyyy.cfg= >=20 >--conf=3Dzzz.cfg -input=3D/usr/local/etc/SEC_Log_Pipe -intevents/ > >I need to log some information also in a log file upon successful=20 >execution of one of my defined rule and i wanted to use the same pipe=20 >for writing it. > [...] >Is there a good way to handle read/write operations through named pipe? >Thanks in advance, The result of using multiple readers on a fifo/named pipe differes from OS to OS, but IIRC only one process will sucessfully read from the pipe in most cases. The fifo doesn't duplicate any data. Once the data is read by a process it is gone. I would just use two seperate fifo/named pipes. Also note that writing to a fifo/named pipe can block if there is no reader so you have to be careful when using the write action to directly write to a fifo so that it doesn't hang the SEC process. -- -- rouilj John Rouillard === My employers don't acknowledge my existence much less my opinions. -- This SF Dev2Dev email is sponsored by: WikiLeaks The End of the Free Internet http://p.sf.net/sfu/therealnews-com ___ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
Re: [Simple-evcorr-users] read/write operations through named pipe
On 12/08/2010 06:45 PM, John P. Rouillard wrote: > > In message<4cffa586.70...@fleetboard.com>, > M Haris Farooque writes: >> I have another question related to Named Pipe. >> I have made a "/usr/local/etc/SEC_Log_Pipe " and hang it with SEC so=20 >> that SEC can read input text from it; >> >> *cmd1*: /perl -w /usr/local/sbin/sec.pl --conf=3Dxxx.cfg --conf=3Dyyy.cfg= >> =20 >> --conf=3Dzzz.cfg -input=3D/usr/local/etc/SEC_Log_Pipe -intevents/ >> >> I need to log some information also in a log file upon successful=20 >> execution of one of my defined rule and i wanted to use the same pipe=20 >> for writing it. >> [...] >> Is there a good way to handle read/write operations through named pipe? >> Thanks in advance, > > The result of using multiple readers on a fifo/named pipe differes > from OS to OS, but IIRC only one process will sucessfully read from > the pipe in most cases. The fifo doesn't duplicate any data. Once the > data is read by a process it is gone. > > I would just use two seperate fifo/named pipes. > > Also note that writing to a fifo/named pipe can block if there is no > reader so you have to be careful when using the write action to > directly write to a fifo so that it doesn't hang the SEC process. John has made an important point here -- the lack of reader stalls the entire SEC process. And if one opens fifo in nonblocking mode, data loss might occur. Since the idea seems to be write some lines into a separate file, I'd recommend to do it from the SEC rule with 'write' action. kind regards, risto > > -- > -- rouilj > John Rouillard > === > My employers don't acknowledge my existence much less my opinions. > > > > > > > > > > > > -- > This SF Dev2Dev email is sponsored by: > > WikiLeaks The End of the Free Internet > http://p.sf.net/sfu/therealnews-com > ___ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > -- This SF Dev2Dev email is sponsored by: WikiLeaks The End of the Free Internet http://p.sf.net/sfu/therealnews-com ___ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
