конфиг syslog-ng:options {
sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (no);
keep_hostname (yes);
};
source ext_logger {
unix-stream ("/dev/log");
udp( ip(xxx.xxx.xxx.xxx) port(xxxx));
internal();
};
destination my_wks { fifo("/logs/scripts/syslog-ng.pipe"); };
log { source(ext_logger); destination(my_wks); flags(final); };
;---------------------------------------------------------------------
скрипт:
#!/usr/bin/perl
my $Pipe='/logs/scripts/syslog-ng.pipe';
use DBI;
my $hLog; #Log file handle
my $dbTable='xxxx'; #Name of dBase Table
my $date=''; #Event date
my $time=''; #Event time
my $user=''; #User
my $code=''; #Event code
my $addr=''; #host ip
%month = ('Jan'=>'01', 'Feb'=>'02', 'Mar'=>'03', 'Apr'=>'04', 'May'=>'05', 'Jun'=>'06', 'Jul'=>'07', 'Aug'=>'08', 'Sep'=>'09', 'Oct'=>'10'
, 'Nov'=>'11', 'Dec'=>'12'); #Month hash
#----------------------------------------------------------------
my $dBase=DBI->connect("dbi:mysql:dbname=xxxxx;host=xxxxx","xxxxxx","xxxxx");
open($hLog, '<', $Pipe) or die("Open Error");
while(<$hLog>)
{
if($_=~/(\S{3})\s?(\d{2})\s?(\d{2}\:?\d{2}\:?\d{2})\s?(\d{4})\s+(\d{3})\s+\S+\s+(\S+)/)
{
# $1=month $2=day $3=time $4=year $5=code $6=user_name
$date=$4.'-'.$month{$1}.'-'.$2;
$time=$3;
$user=$6;
$code=$5;
}
if(substr($user,-1,1) eq '$')
{
$addr=$user;
chop($addr);
}
elsif($_=~/(\d+\.{1}){3}\d+/) # $& - ip addr
{
$addr=$&;
}
$dBase->do("insert into ".$dbTable." (date,time,user,ip,code) values ('".$date."','".$time."','".$user."','".$addr."',".$code.");");
$date, $time, $user, $code, $addr='';
}
Вариант для распечатки
Программирование под UNIX (Public)
(ok) on 22-Мрт-08, 21:48 
