[syslog-ng] Re: swatch in syslog-ng

[Dhawal Doshy]

R. V. C. wrote:
> List,
> 
> I am trying  (in vain) to get swatch to work with
> syslog-ng.
> Here is a list of my system specifics:
> Freebsd 6.2
> syslog-ng-1.6.11
> swatch-3.1.1_1
> stunnel-4.20
> mysql-client-5.1.14
> mysql-server-5.1.14
> 
> Ok so here is the problem. I can get swatch to read a
> file via the
> tail-file option:
> destination swatch { program("/usr/local/bin/swatch
> --config-file=/root/.swatchrc
> --tail-file=/var/log/all.log"); };
> 
> This works fine.
> 
> However when I try to use the read-pipe option,
> nothing ever comes out:
> destination swatch {
> program("/usr/local/bin/swatch --read-pipe=\"cat
> /dev/fd/0\"");
> };

Though not a solution to your problem, see SEC 
(http://www.estpak.ee/~risto/sec/), a fine replacement to swatch IMHO..