> On 6/5/07, Alexander Clouter <ac56@soas.ac.uk> wrote:
> >
> >If you are logging to a file and having Perl munch on a log file you can
> >remove the perl script and pipe from the whole works. syslog-ng can be
> >configured to read in directly a log file; it effectively does a 'tail -f'
> >on the file.
>
> Except for cases where you need the Perl script to post-process the log file
> to produce a normalized or custom syslog message format.
>
Agreed, however a better design would be:
<Log> ---> <Perl> ---> <Log2>
<Log2> --[using 'tail' function]--> syslog-ng -> syslog-ng
These would be disconnected and you would not run into any nasty problems.
Another advantage being that if the perl code soaks up the CPU cycles and the
logging is not urgent (needed at the final destination ASAP) you could nice
down the priority of the process to prevent it stomping in on syslog-ng's
performance.
But that scenario only supports logs that are "syslog friendly". If you have to do any kind of normalization or post-processing or dealing with multi-line records in a log file, you have to use a post-processing process such as Perl. Not all logs have human-friendly readable text and the post-processing Perl script can translate the log record into something more useful.
The CPU cycles required by Perl parsing is minimal and is a common myth that Perl is a CPU hog. I have Perl scripts processing billions of log events per week.