On Mon, Dec 23, 2002 at 02:24:27PM +0200, Mika S. Marjamaki wrote:

However, I don't like running swatch as root. Central loghost Mini-HOWTO <http://www.campin.net/newlogcheck.html> suggests that I could run swatch as a different user with a configuration like this:

- - - syslog-ng.conf destination swatch { program("su syslog -c '/usr/bin/swatch --config-file=/etc/swatchrc --read-pipe="cat /dev/fd/0"' "); }; - - -

That kind of configuration does not work for me, though. I noticed that I had to put backslashes in front of "-signs around "cat /dev/fd/0".

Oh, yeah. I converted my site from one set of Mason templates to another and some global search-and-replace operations must have been overzealous, the backslashes used to be in the example. The backslashes are back again. As for the su, that's anyone's guess. I'd do a couple things: 1) put the full path to su in the syslog-ng conf file 2) capture the output of the command to see the error (http://www.campin.net/syslog-ng/faq.html#capture_output) 3) as root manually try that command to make sure it's correct Come back to the list with the output of these steps. -- Nate Campi http://www.campin.net "My company doesn't know Usenet exists, and my boss would have kittens if he thought I spoke for them. My opinions are better than theirs anyway." - Unknown found in a .signature