7 use Data::Dump qw/dump/;
20 $sock->recv($buf, $MAXLEN);
24 my ($port, $ipaddr) = sockaddr_in($sock->peername);
26 ip => join('.', unpack('C4',$ipaddr)),
30 if ( $buf =~ s/<(\d+)>// ) {
32 $log->{facility} = ( $1 - $log->{pri} ) / 8;
34 $log->{timestamp} = $1 if $buf =~ s/^(\w\w\w\s+\d+\s+\d\d:\d\d:\d\d)\s*//; # strip timestamp which some syslog servers insert here
36 if ( $buf =~ s/^([^:]+)\s*:\s*// ) {
38 if ( $tag =~ m{^(\S+)\s(\S+)} ) {
40 $log->{hostname} = $1;
45 if ( $log->{tag} =~ s/\[(\d+)\]$// ) {
47 } elsif ( $buf =~ s/^(\d+):\s*// ) {
52 $log->{tag} =~ s{^/.+/([^/]+)$}{$1};
54 if ( $log->{tag} =~ m{CRON}i && $buf =~ m{^\((\w+)\) (.+) \((.+)\)$} ) {
62 if ( $buf =~ m{(init|error|mount|smart|usb|fs)}i ) {
63 $log->{category} = $1;
66 $log->{message} = $buf;
69 warn "log ",dump( $log );
70 store::audit( $log->{tag}, $log );
75 my $sock = IO::Socket::INET->new(
79 ) || die "can't listen to $port: $!";
81 store::audit('start', { port => $port });
90 my $rsyslog = '/etc/rsyslog.d';
91 return unless -d $rsyslog;
92 $rsyslog .= '/pxelator.conf';
93 warn "# redirect local syslog to pxelator using $rsyslog";
94 write_file $rsyslog, "*.*\t\@$server::ip\n";
95 system "( /etc/init.d/rsyslog stop ; sleep 2 ; /etc/init.d/rsyslog start ; rm $rsyslog ) &";