From owner-freebsd-questions Sun Mar 10 12:51: 3 2002 Delivered-To: freebsd-questions@freebsd.org Received: from rwcrmhc51.attbi.com (rwcrmhc51.attbi.com [204.127.198.38]) by hub.freebsd.org (Postfix) with ESMTP id 5E34237B402 for ; Sun, 10 Mar 2002 12:51:00 -0800 (PST) Received: from blossom.cjclark.org ([12.234.91.48]) by rwcrmhc51.attbi.com (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020310205056.KDBI2626.rwcrmhc51.attbi.com@blossom.cjclark.org>; Sun, 10 Mar 2002 20:50:56 +0000 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.6) id g2AKouh24434; Sun, 10 Mar 2002 12:50:56 -0800 (PST) (envelope-from cjc) Date: Sun, 10 Mar 2002 12:50:56 -0800 From: "Crist J. Clark" To: "Eric I. Arnoth" Cc: freebsd-questions@FreeBSD.ORG Subject: Re: syslog.conf problems Message-ID: <20020310125056.R57999@blossom.cjclark.org> Reply-To: cjclark@alum.mit.edu References: <20020221030958.QQRM18863.femail11.sdc1.sfba.home.com@there> <20020221041623.Q48401@blossom.cjclark.org> <20020222033846.MDLM14626.femail23.sdc1.sfba.home.com@there> <0GSQ002AUAHYKE@mtaout01.icomcast.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <0GSQ002AUAHYKE@mtaout01.icomcast.net>; from earnoth@comcast.net on Sat, Mar 09, 2002 at 05:55:46PM -0500 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Sat, Mar 09, 2002 at 05:55:46PM -0500, Eric I. Arnoth wrote: > Since the original thread below, I've come quite a long way in my script, but > now I have more difficult issue. Syslog calls the script correctly, but I > find it does not call the script for every instance of the event logging > which I have set it up for. > > Specifically, I have written a Python script to read & parse ipfw output from > syslog. I have added the following line to my syslog.conf file: > > security.* |exec /root/ipfwloggerc.py > > But not every firewall log event which is written to /var/log/security > results in an execution of /root/ipfwloggerc.py. In simple tests, I > truncated the script to simply append the output to a file, and do no > processing. On the average there was between 40% - 60% execution rates > > What's going on? Is this a syslog issue? If anyone replies, please be sure > to CC me, as I do not subscribe to this list anymore. I can't reproduce this using simple shell scripts. It's hard to diagnose without a look at the complete syslog.conf(5) and the script you are using. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message