[syslog-ng]destination { program(); } failures...

[David Douthitt]

Gregor Binder wrote:

> actually, I think apart from not being clearly documented, program()
> works well :)

I'll change that if someone doesn't fend me off :-)

> I have been using it with a script that triggers notifications every X
> messages and/or every X seconds. This can be done really easy by
> spawning a subshell, storing its PID, and using a sleep timer in the
> parent. The child reads STDIN and watches the message treshold.
> 
> I think what most people think program() is for, is spawning their
> script for every message, which is obviously not a good thing to do :)

Well, that would be the OBVIOUS thing to do - though from a system
standpoint, that would likely lead to some serious performance
degradation.  The idea of continually "feeding message after message"
makes more sense, but has to be programmed for, and isn't the first
thing thought of.

I also noticed that the messages thus sent still have their
syslog-based "<99>message" format; is there - could there be - an
option to strip the "<XX>" from the message?  My program which is
responding is a generic program so I don't want to put it in there -
it responds to things other than syslog messages.