0

I have set up syslog-ng to tail a file and forward each new event to python script which will process it.

My syslog-ng.conf looks like this - 

source s_src {
   file("/var/log/xyz.log" flags(no_parse);
};

destination d_dest {
   program("python -u /home/user1/processlog.py" flush_lines(1) flags(no_multi_line));
};

log { source(s_src); destination(d_dest); };

And processlog.py just contains

#!/usr/bin/python
import sys

f1 = open('success.txt', 'a')

while 0 < 1:
  try:
    line = sys.stdin.readline()
    f1.write(line)

  except Exception, e:
    f = open('/tmp/error.txt','ab')
    f.write(e)
    f.close()
    exit(0)

This script works prefectly fine from command line. Takes each input and writes to success.txt.

Syslog-ng also starts but does not forward the event to python program above. It starts the program though. 

ps -ef| grep processlog
root      6242  6236  0 13:00 ?        00:00:00 /bin/sh -c python -u /home/user1/processlog.py
root      6244  6242  0 13:00 ?        00:00:00 python -u /home/user1/processlog.py

I have checked all permissions too. But whenever new event happens in xyz.log, it is not getting forwarded to python script, which i am testing via writing to success.txt

Any leads are highly appreciated.

bradym
  • 4,880
  • 1
  • 31
  • 36
cmbendre
  • 99
  • 2
  • 11
  • How do you know it is not forwarding? It will not appear in `success.txt` immediately because of buffering. If you want that, then call `f1.flush()` after `f1.write(line)`. – cdarke Sep 07 '15 at 07:56
  • I added f1.flush() as you said, but it still does not appear in the success.txt. My purpose is to test if the event is getting processed immediately. – cmbendre Sep 07 '15 at 09:04

1 Answers1

1

Try to run syslog-ng in foreground mode with enabled debug messages

syslog-ng -Fedtv

Perhaps you will get information about why the program destination doesn't get the messages.

By the way, is it possible that the syslog-ng read this file once?

In this case you should delete the persist file (var/syslog-ng.persist) to force the syslog-ng to read this file from beginning.

Wilson
  • 11
  • 2