[syslog-ng] parser

[Yüce Sungur]

I am developing  a  reporting application based on  syslog-ng log files,
this is a fw log file, 
there is a  filter in syslog-ng definition matching the "teardown" keyword, then it writes to a pipe
and there is my perl  code running in background and parsing the logs and inserts to db,
 
when I check for the log file with grep -c -i teardown  and my db entries there is a difference of % 0.3
 
you think  using program() in syslog-ng is more efficient than reading pipe,or instead of reading a pipe and filtering with syslog-ng, I can tail with perl the log file, and filter by perl?
 
 
any ideas??
 
and maximum log entries per second is around 500  and filetred results must be the half,,
 

Yüce  SUNGUR

Türkiye İş Bankası A.Ş.

Genel Müdürlük

Bilgi İşlem Müdürlüğü

İŞ Kuleleri Kule-1 Kat 3

34330 Levent/İstanbul

 

Tel: +90 (212) 316  88 49

Fax:+90 (212) 316  0938

Cep:+90  532   748  5466

Yuce.sungur at isbank.com.tr

 

 

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20071010/c11abcdc/attachment.htm