Solved syslog piped to script

K

kisscool-fr

Hi,

Playing with syslog recently, I found a strange behaviour at some point and I am looking for some explanation.

From man pages and even from some results of my research, piping to script should be done like that

Code: 
+sourcehost
*.*    |exec /usr/local/sbin/myscript.sh
*.*    /var/log/directfile

myscript.sh has this
Code: 
#!/bin/sh

echo $* >> /tmp/logfile

So each time I have some log from sourcehost, myscript is triggered. The problem is with what is appended to logfile. I have only empty lines. In directfile I have correct log lines.

With different tries, I changed the exec part to
Code: 
*.*    |exec awk 'lf="/tmp/logfile"; {print $0 >> lf }'
and after the change, logfile has correct log lines.

I read about stdin/stdout/stderr redirection when piping and using exec, but my different tries were not successful.

So I am searching for any idea what is happening here.

Thanks,
K.
 
pretty useless use of cat 🙈 but then, in a more realistic scenario, the script would probably do some processing first.

kisscool-fr the log line isn't passed as a parameter but written to the script's standard input. The arguably easiest way to access a script's standard input is probably the read command, which is a builtin in sh(1) (so, see this manpage).
 
Thanks to both of you.

covacat the use of cat as you mention seems to work. I have identical lines in both of log files in real time now. But as zirias@ added, I also do some processing (my samples were just basic samples that show the problem). And with cat I can't catch the logline to filter/alter it.

I'll try with read to see what is possible.
 
I'll have to see how it works at the long term but with read I am able to catch the message

Code: 
#!/bin/sh

# catch message
read MSG

# do any processing to MSG then
# ...

Thanks,
 
chrbr I am not sure how logger is supposed to help me here. It allows to send messages to syslog. I want to filter what is leaving syslog and goes to files.
 
You must log in or register to reply here.
Back
Top