2013/3/15 John P. Rouillard <[email protected]>: > > In message <[email protected]>, > Risto Vaarandi writes: >>On 12/15/2012 12:01 AM, mindman101 wrote: >>> Does anyone know how to send an event to syslog-ng under sec rules? >>> >>> I mean, something like: >>> >>> action: send_syslog(facility, level, event) >>> >>> Thanks for your support. >> >>In the 2.7.1 version, one efficient way for this is communicating >>directly with the /dev/log socket. This is useful if you want to issue >>events with different tags (program names), since standard openlog(3) >>and syslog(3) calls do not allow for changing the syslog tag. > > What's the format of the entry that should be sent to /dev/log? > >>There is an updated example on this topic in the SEC rule repository: >>http://simple-evcorr.sourceforge.net/rulesets/syslog-custom.sec >>This example also illustrates how to encapsulate your own code into a >>custom Perl module, instead of writing the code directly into SEC rules. > > Nice. > > In addition you could just pipe output into a call to logger which > just submits a syslog even to the local syslog server (presumable > syslog-ng on on your box)
One additional new feature that the 2.7.1 version has is that 'write' action now keeps the output files open across writes. So if one wishes to write events with identical tag, facility and severity, a single 'logger' process can be started on a named pipe which will run as long as SEC keeps the named pipe open for writing (normally until SIGHUP, SIGABRT or SIGUSR2). Compared to the 'pipe' or 'shellcmd' actions this can be much more efficient if large amounts of events are handled, since only one process has to be forked. To handle signals like HUP or ABRT, a simple 'while true .. done' style of shell wrapper could be written around 'logger', so that it gets restarted when named pipe gets closed. kind regards, risto > > -- > -- rouilj > John Rouillard > =========================================================================== > My employers don't acknowledge my existence much less my opinions. > > ------------------------------------------------------------------------------ > Everyone hates slow websites. So do we. > Make your web apps faster with AppDynamics > Download AppDynamics Lite for free today: > http://p.sf.net/sfu/appdyn_d2d_mar > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_mar _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
