In message <[email protected]>,
Clayton Dukes writes:
>I'm wondering if it's normal for sec to spawn multiple processes for
>every incoming message?
>
>I'm using syslog-ng, my config:
>destination d_sec {
> file("/var/log/sec_debug.log"
> template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t
>$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n")
> template_escape(no));
> program("/usr/bin/sec -input=\"-\" -conf=/etc/sec/cisco.conf
>-log=/var/log/sec_run.log -intevents -debug=5"
> template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t
>$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n")
> );
>};
>
>log {
> source(s_all);
> destination(d_sec);
>};
>
>
>And my test config for sec:
>#################################################
># %CCM_CALLMANAGER-CALLMANAGER
>type=Single
>ptype=RegExp
>pattern=(.*CCM_CALLMANAGER-CALLMANAGER.*)
>desc=CallManager
>action=pipe '$1' /www/svn/php-syslog-ng/scripts/sec_db_dedup.pl
>
>
>The sec_db_dedup.pl script is doing database inserts and exiting.
>When I run syslog-ng, I get 30-40 processes for sec_db_dedup.pl and
>another 30-40 processes for sec
>Is this normal behavior?
Yes. pipe is the same as shellcmd, except it sends data on stdin. What
you may want is the opposite of a spawn command: i.e. a persistant
process that sec can write to (spawn provides a persistant process
that sec can read from).
When I did this, I used (the equivalent of):
shellcmd 'tail -F /tmp/file | command'
that fired when sec started up (see -intevents in the man page). This
initial shellcmd is responsible for making sure that 'command'
exists/restarts if it crashes etc... Once you have that set up, send
data to it using:
write /tmp/file .....
in place of the pipe command.
This sets up a persistant 'command' process and sends data via a
file. Using a pipe is another possibility. Using -F on the tail allows
rotation of the file to happen without restarting the tail/command.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
