Re: Filtering socklog output revisited

Hi!

On Tue, Aug 29, 2006 at 10:54:20PM +0000, Lloyd Zusman wrote:
> But based on the discussion I referred to above, that is not recommended,
> and therefore, I posted this question here to see if perhaps there's some
> other way to do this using socklog.

AFAIK problem with pipes is what you doesn't control some of processes
involved in pipe. Actually, between socklog and svlogd there IS a pipe,
but both socklog and it's svlogd independently monitored by runsv, and
if one of them die runsv will restart it and attach it input/output to
that pipe.

So, if you do something like this in socklog-unix/run file:

    chpst -Unobody socklog unix /dev/log | myfilter

then you'll have few problems. At first, if myfilter die it will not be
restarted and after some time socklog hangs because it's stdout buffer
will be full. At second - you can't use bash's "exec" here, so runsv will
really monitor bash (which running socklog and myfilter and support pipe
between them) instead of socklog. (BTW, some time ago I've developed simple
script which allow you to use "exec" here, so runsv will monitor socklog
and you will not have additional bash running, but anyway myfilter will
not be monitored by runsv.)

This issue can be solved by creating FIFO file on disk and adding one
more service:
1) You delete socklog-unix/log/run.
2) You redirect all output from socklog-unix/run into some FIFO file,
   for ex. /var/log/syslog.fifo (create it with mkfifo command).
3) You create new service, syslog-filter/run, which input redirected from
   /var/log/syslog.fifo and which doing "exec myfilter".
4) You create new log service for actually writing logs to disk,
   syslog-filter/log/run, which is just an exact copy of deleted
   socklog-unix/log/run.

Weak place of this: you MUST have your syslog-filter service ALWAYS
running, or socklog-unix also hangs on writing to /var/log/syslog.fifo.
But now all processes involved in pipe monitored by runsv.

-- 
			WBR, Alex.