[syslog-ng] Re: syslog-ng, file source driver

[Bradley Urberg Carlson]

On Wed, 1 Mar 2000, Balazs Scheidler wrote:

> ops, this is a docbug. earlier syslog-ng was able to do this, but this maxed
> out CPU usage. It is not possible to decide whether new data arrived to a
> file using poll()

I do a tail-like operation and sleep a predetermined interval between
fgets.  If you set the pause high-enough, it doesn't take much CPU (but
then, the logfile is processed on bursts, and not so smoothly).

char *fileName = "/var/log/syslogfile";
FILE *fileDescriptor;
char *ptr;
char buffer[510];
/* sleep 30 seconds between log-file reads */
int sleepLength = 30;
/* 20 consecutive reads with no data = frozen log file */
int maxReads = 36;

int EOFile = 0; /* not yet at the end of the log file */
int whatever_procedure (void) {
	if ((fileDescriptor = fopen (fileName, "r")) == (FILE *) NULL)
	{
		fprintf (stderr, "Couldn't open logfile: %s\n", fileName);
		return (0);
	}
	/* if EOFile == 0, we're not at the end of the log file */
	/* if EOFile == 1, we're at the end of the file, and read good data */
	/* if EOFile > 1, it is the number of reads with no new data */
	for (;;) {
		while (fgets (buffer, sizeof (buffer), fileDescriptor) != (char *) NULL)
		{
			/* skip ahead to the end of the logfile */
			if (EOFile != 0) 
			{ /* now we're tailing the end of the logfile */
				EOFile = 1;
/* Now do whatever you want with the buffer[] that was read from the logfile */
			}
		}
		EOFile++;
		if (EOFile > maxReads) /* too many reads with no data, try reopening logfile */
		{
			fclose(fileDescriptor);
			if ((fileDescriptor = fopen (fileName, "r")) == (FILE *) NULL)
			{
				fprintf (stderr, "Couldn't open log file: %s\n", fileName);
				return (0);
			}
			EOFile = 0;
		}
		sleep (sleepLength);
	}
}