That seems to have made it worse...what am I doing wrong?
Here's what I have:
#################################################
# %CCM_CALLMANAGER-CALLMANAGER
type=Single
ptype=RegExp
pattern=(.*CCM_CALLMANAGER-CALLMANAGER.*)
desc=CallManager
action=write /tmp/sec.log $1
action=shellcmd tail -F /tmp/sec.log |
/www/svn/php-syslog-ng/scripts/sec_db_insert.pl
On Fri, Jun 26, 2009 at 10:38 AM, John P. Rouillard<rou...@cs.umb.edu> wrote:
>
> In message <e54865560906260700g1d87f860l199f8785efe5f...@mail.gmail.com>,
> Clayton Dukes writes:
>>I'm wondering if it's normal for sec to spawn multiple processes for
>>every incoming message?
>>
>>I'm using syslog-ng, my config:
>>destination d_sec {
>> file("/var/log/sec_debug.log"
>> template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t
>>$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n")
>> template_escape(no));
>> program("/usr/bin/sec -input=\"-\" -conf=/etc/sec/cisco.conf
>>-log=/var/log/sec_run.log -intevents -debug=5"
>> template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t
>>$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n")
>> );
>>};
>>
>>log {
>> source(s_all);
>> destination(d_sec);
>>};
>>
>>
>>And my test config for sec:
>>#################################################
>># %CCM_CALLMANAGER-CALLMANAGER
>>type=Single
>>ptype=RegExp
>>pattern=(.*CCM_CALLMANAGER-CALLMANAGER.*)
>>desc=CallManager
>>action=pipe '$1' /www/svn/php-syslog-ng/scripts/sec_db_dedup.pl
>>
>>
>>The sec_db_dedup.pl script is doing database inserts and exiting.
>>When I run syslog-ng, I get 30-40 processes for sec_db_dedup.pl and
>>another 30-40 processes for sec
>>Is this normal behavior?
>
> Yes. pipe is the same as shellcmd, except it sends data on stdin. What
> you may want is the opposite of a spawn command: i.e. a persistant
> process that sec can write to (spawn provides a persistant process
> that sec can read from).
>
> When I did this, I used (the equivalent of):
>
> shellcmd 'tail -F /tmp/file | command'
>
> that fired when sec started up (see -intevents in the man page). This
> initial shellcmd is responsible for making sure that 'command'
> exists/restarts if it crashes etc... Once you have that set up, send
> data to it using:
>
> write /tmp/file .....
>
> in place of the pipe command.
>
> This sets up a persistant 'command' process and sends data via a
> file. Using a pipe is another possibility. Using -F on the tail allows
> rotation of the file to happen without restarting the tail/command.
>
> --
> -- rouilj
> John Rouillard
> ===========================================================================
> My employers don't acknowledge my existence much less my opinions.
>
--
______________________________________________________________
Clayton Dukes
______________________________________________________________
------------------------------------------------------------------------------
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
