John P. Rouillard wrote: >>>> The sec_db_dedup.pl script is doing database inserts and exiting. >>>> When I run syslog-ng, I get 30-40 processes for sec_db_dedup.pl and >>>> another 30-40 processes for sec >>>> Is this normal behavior? >>> Yes. pipe is the same as shellcmd, except it sends data on stdin. What >>> you may want is the opposite of a spawn command: i.e. a persistant >>> process that sec can write to (spawn provides a persistant process >>> that sec can read from). >>> >>> When I did this, I used (the equivalent of): >>> >>> shellcmd 'tail -F /tmp/file | command' >>> >>> that fired when sec started up (see -intevents in the man page). > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > This is what you missed. You only run the tail pipeline once on > startup of SEC. > > So something like: > > type = single > ptype = ... > pattern = true > context = SEC_STARTUP > action = shellcmd tail -F /tmp/sec.log | \ > /www/svn/php-syslog-ng/scripts/sec_db_insert.pl > >> Here's what I have: >> ################################################# >> # %CCM_CALLMANAGER-CALLMANAGER >> type=Single >> ptype=RegExp >> pattern=(.*CCM_CALLMANAGER-CALLMANAGER.*) >> desc=CallManager >> action=write /tmp/sec.log $1 >> action=shellcmd tail -F /tmp/sec.log | >> /www/svn/php-syslog-ng/scripts/sec_db_insert.pl > > Hmm, that should throw an error I think. Two action statements aren't > valid AFAIK. Risto? >
Actually, the later 'action' value overrides the earlier one. So for having two actions, one has to write them as a list to one 'action' field, with a semicolon acting as a separator. risto ------------------------------------------------------------------------------ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
