From owner-freebsd-questions@freebsd.org  Wed Apr  5 15:13:05 2017
Return-Path: <owner-freebsd-questions@freebsd.org>
Delivered-To: freebsd-questions@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3AA5BD30ECB
 for <freebsd-questions@mailman.ysv.freebsd.org>;
 Wed,  5 Apr 2017 15:13:05 +0000 (UTC)
 (envelope-from smithi@nimnet.asn.au)
Received: from sola.nimnet.asn.au (paqi.nimnet.asn.au [115.70.110.159])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id B572BFBA
 for <freebsd-questions@freebsd.org>; Wed,  5 Apr 2017 15:13:03 +0000 (UTC)
 (envelope-from smithi@nimnet.asn.au)
Received: from localhost (localhost [127.0.0.1])
 by sola.nimnet.asn.au (8.14.2/8.14.2) with ESMTP id v35FCiH4062838;
 Thu, 6 Apr 2017 01:12:44 +1000 (EST)
 (envelope-from smithi@nimnet.asn.au)
Date: Thu, 6 Apr 2017 01:12:44 +1000 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
To: Ernie Luzar <luzar722@gmail.com>
cc: freebsd-questions@freebsd.org
Subject: Re: syslog.conf - log records to a script
In-Reply-To: <mailman.33104.1491386390.4389.freebsd-questions@freebsd.org>
Message-ID: <20170405234624.T53970@sola.nimnet.asn.au>
References: <mailman.33104.1491386390.4389.freebsd-questions@freebsd.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 05 Apr 2017 15:13:05 -0000

In freebsd-questions Digest, Vol 670, Issue 3, Message: 7
On Tue, 04 Apr 2017 15:22:15 -0400 Ernie Luzar <luzar722@gmail.com> wrote:

 > In syslog.conf I have these 2 lines.
 > local0.*       /var/log/security
 > local0.*      | exec /usr/local/bin/ipf.table

The example in syslog.conf(5) uses no space between '|' and 'exec'.  I'm 
not sure whether that matters, but it's easy to test.

 > The security log file is being populated and working fine.
 > Now I want to pipe the same log records to a script for processing.
 > 
 > I'm using a very simple script to verify that the test script is being 
 > handed all the log records. My test ipf.table script looks like this,
 > 
 > #! /bin/sh

It's traditional (at least) to have no space between '#!' and '/bin/sh'.
I'm not entirely sure that matters either, but it's also an easy test.

 > read line
 > echo "$line" >> /var/log/ipf.table.log
 >
 > When I issue  "service syslogd restart"  I get no errors.
 > 
 > The ipf.table.log gets populated with the first log record and them 
 > nothing happens after that even though I can see more entries being 
 > logged to /var/log/security.
 > 
 > What am I doing wrong here?

I'm not sure :)

Is /usr/local/bin/ipf.table owned by root and set executable?
Any error reports in /var/log/messages or /var/log/console.log?

cheers, Ian