<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<pre style="word-wrap:break-word; font-size:10.0pt; font-family:Tahoma; color:black">Couldn't you just use flush_lines(1) for that destination?
Evan Rempel 250.271.7691
University Systems, University of Victoria
Balazs Scheidler <bazsi77@gmail.com> wrote:
</pre>
<div>
<p dir="ltr">I think we could accomodate this use case with a separate driver/scl snippet.</p>
<p dir="ltr">Smtg like</p>
<p dir="ltr">Destination { procfile(...) };</p>
<p dir="ltr">What options eould you think are needed in this usecase)</p>
<div class="gmail_quote">On Sep 6, 2013 5:43 PM, "Valentijn Sessink" <<a href="mailto:valentyn@blub.net">valentyn@blub.net</a>> wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
On 04-09-13 14:40, Gergely Nagy wrote:<br>
> This has been fixed in 3.4's git tree, and will be part of 3.4.4<br>
> release.<br>
<br>
I tried it, but it doesn't seem to help. There's something weird about<br>
the xt_recent.c file handling. I tried to understand it's source, but I<br>
couldn't find out. It seems that *loff is different from file->f_pos,<br>
and can't be simply changed with lseek().<br>
<br>
Bottom line is, that although *loff should be 0, an lseek() will not help.<br>
<br>
So I kindly suggest: please revert any changes that you made to<br>
accomodate to this /proc thing - they are of no use, at this moment.<br>
<br>
For now, xt_recent should be written with single lines only,<br>
open()-write()-close() and repeat. Even using program("cat > ....")<br>
doesn't work correctly; it will write the first IP address, then fail<br>
with the second, bail out, and syslog_ng will start another cat to write<br>
the next IP-address.<br>
<br>
"most proc files support only one-shot writes" is what I learned from<br>
someone at #kernelnewbies, so that's probably the final word on this.<br>
<br>
I think the best thing is using some sort of piping program in between;<br>
I'm not sure what I'm going to use - should any of you readers have a<br>
good idea, please say so.<br>
<br>
After a couple of days of trying to grasp xt_recent.c in combination<br>
with syslog-ng file() - without avail :-( - I'm going to have a beer.<br>
That won't help my logging, but it will help my mood! Happy friday<br>
afternoon, dear fellow Europeans ;-) and have a nice weekend for all of you.<br>
<br>
Best regards,<br>
<br>
Valentijn<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote>
</div>
</div>
</body>
</html>