[syslog-ng] program1 destination

[Kalin KOZHUHAROV]

Bryan Henderson wrote:
> I'm thinking about adding a destination type "program1" that is like
> "program" except it runs a separate process for each message and passes
> the message as an argument instead of Standard Input.
> 
> Does this sound like a good idea?
Nope, not in this stage (=idea). It will be extremely easy to DoS the server
if you have, say 10 MSGs of your kind in a second (or 100, or 1000). AFIAK,
fork is one of the most expensive operations, so spawning a new process per
MSG is probably a big overhead for nothing.

> I'm expecting to use it run a program that emails the message to me,
> and use it for "alert" level messages.
Find a daemon that does just that. Or write your own that has two
threads/processes:

1. Read from STDIN (piped from syslog-ng) and buffer the input to $VAR.
2. if ($VAR != ''){mail($VAR); sleep $some_time;}

Not sure if 1 is needed and you can rely on OS for buffering of pipeed data.

Just my 2 yen.

Kalin.

-- 
| A |
| D |
| J |
| P |