All,

I have a program driver setup in the syslog-ng.conf file to execute a perl script which sends an email with fixed content based on a syslog message.

This first time I run syslog-ng with the program driver, syslog-ng and the script appear in a “ps –ef” listing as mentioned in the syslog-ng docs.:

“NOTE: the program is executed once at startup, and kept running until SIGHUP or exit. The reason is to prevent starting up a large number of programs for messages, which would imply an easy DoS.”

The first time the conditions are met to send the email it works but the script which was listed with syslog-ng in a “ps-ef” no longer appears in a “ps –ef” and I can not seem to get it to start again.  “service syslog-ng restart” or “stop” then “start” does not work.  Reboot does not work.

How can I get this script ready to send another alert after it has been triggered?

The following are pertinent lines from the syslog-ng.conf file.

source s_sys { unix-stream("/dev/log"); internal(); };

destination d_mail-me { program("/etc/syslog-ng/test-mail.script"); };

filter f_filter9     { match("for user"); };

log { source(s_sys); filter(f_filter9); destination(d_mail-me); };

thanks,

David