Sys::Syslog question

[Dave Saville]

I am writing a script that takes a named pipe as input, does a little
massaging of the text and then writes it to syslog. The data could
come infrequently or in bursts depending on the output of the daemon
whose pipe I am reading.

The question is, which is best practice?

1) Inside the read pipe loop - openlog, write, close log for every
line.
2) Openlog outside the pipe read loop and write each line as it comes?
ie keep the file open.

Google does not suggest an answer. I tend to 1) but it is a heck of an
overhead if a few thousand lines hits the fan.

TIA

 

[Martijn Lievaart]

I am writing a script that takes a named pipe as input, does a little
massaging of the text and then writes it to syslog. The data could come
infrequently or in bursts depending on the output of the daemon whose
pipe I am reading.

The question is, which is best practice?

1) Inside the read pipe loop - openlog, write, close log for every line.
2) Openlog outside the pipe read loop and write each line as it comes?
ie keep the file open.

What's wrong with option 2?

M4

 

[Dave Saville]

What's wrong with option 2?

Well I am not sure if keeping an open connection to the syslogd daemon
for days on end is a good idea

 

[Martijn Lievaart]

Well I am not sure if keeping an open connection to the syslogd daemon
for days on end is a good idea

Think about it this way (although I may be wrong). The only real problem
that can occur is restarting the syslog deamon and thus losing the
connection. But if that was a real problem, it can happen anytime between
opening syslog and writing to it. So Either there is no problem, or the
problem must be addressed anyhow.

But maybe someone else knows more? You could also ask in a Unix group, as
this is actually more about the clib functionality than the perl wrapper
around it.

HTH,
M4

 

[Eric Pozharski]

Well I am not sure if keeping an open connection to the syslogd daemon
for days on end is a good idea

Sysloging over network is of UDP kind, thus no-connection. OTOH, if
there's any connection with /dev/log I can't say without investigation
(and, honestly, I'm not interested). And please note, fork(2) is
costly. open(2) isn't. You can safely (if you wish) open-write-close.
With amounts of bytes you're going to syslog you'll see no problems.

 

[Dave Saville]

Sysloging over network is of UDP kind, thus no-connection. OTOH, if
there's any connection with /dev/log I can't say without investigation
(and, honestly, I'm not interested). And please note, fork(2) is
costly. open(2) isn't. You can safely (if you wish) open-write-close.
With amounts of bytes you're going to syslog you'll see no problems.

Thanks - going for option 2 and see if I get any problems.