Hello, A long time ago the program() destination worked as you expect, one program execution per log line. However this is very inefficient so it was changed to execute the program once and syslog-ng feeds its stdin - so you've got to implement a loop in your app which handles incoming messages one by one until syslog-ng exits and your app will get an EOF. Regards, Sandor On 04/20/2018 06:39 PM, Scappatura Rocco wrote:
Hello.
I have written a C program that read the successful POP3 access log lines to my POP3 server. After get one line, it get the time and the POP3 account that logged in. These data are then stored in the account MySQL database.
The program (named 'pop3_access') works fine:
echo "Apr 10 12:00:17 mail1 pop3d: LOGIN, user= xxx@domain.tld, ip=[::ffff:xxx.yyy.zzz.vvv], port=[56196]"|./pop3_access
Infact quering DB, I get:
username pop3_last_access xxx@domain.tld 2018-04-10 12:00:17
I have configured syslog:
filter f_pop3_access { facility(local7) and match ('LOGIN,'); }; destination d_pop3_last_access { program("/usr/local/bin/pop3_access >/dev/null" ); }; log { source(src); filter(f_pop3_access); destination(d_pop3_last_access); };
But no rows are inserted in the database..
From log of destination program 'pop3_access' I see the it remains in a while loop waiting for an 'EOF' that never arrives:
while (fgets(line, MAXSTR, stdin)) { if (sscanf(line, "%s %d %s %s %s %s %s %s %s", mese, &giorno, ora, s, proto, comando, u, ip, porta) != 9){ syslog (LOG_NOTICE, "Errore scanf"); exit(-1); } }
How I have to do so that my program succeed in taking the syslog row correctly, and then returns after process the data as expected?
Regards,
Rocco Scappatura ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq