Hi Matthew,
I found a problem with Debian Sarge using perl v5.8.4.
If you start exitop with a log file as parameter and this log file is
smaller then $blocksize then exitop will die. Here is an example:
My exim mainlog file starts with the following line:
2008-11-21 06:31:40 1L3OcG-0006z7-Nc <= nagios@??? U=nagios
P=local S=582 from <nagios@???>
After calling "./exitop /var/log/exim4/mainlog" it dies with the
following messages spread over the screen:
Day too small - -716281 > -24856
Sec too small - -716281 < 78352
Cannot handle date (40, 31, 06, 21, 10, 8) at ./exitop line 512
I did some research and and could nail down the problem:
The first problem is the the 8 for the year (last parameter of
timelocal) in line 512:
my $msgtime = timelocal($t[2], $t[1], $t[0], $d[2], $d[1] - 1, $d[0] -
1900);
The log file starts with "2008-11-21" but addline() gets only
"08-11-21". The reason for this is the sysseek() call in line 192:
sysseek($$logs{$file}{fh}, -$blocksize, 2);
It returns "undefined" on my Debian Sarge when the log file is smaller
then $blocksize. For some reason I do not understand the following
do-block reads exactly the first 2 bytes from the log file (the
missing "20" from the date string).
With a small patch it works also for my system:
diff -uNr orig/exitop-0.05 new/exitop-0.05
--- orig/exitop-0.05 2008-11-20 14:05:46.000000000 +0100
+++ new/exitop-0.05 2008-11-21 14:30:46.141465623 +0100
@@ -189,12 +189,13 @@
$$logs{$file}{inode} = $st[1];
# Skip back one blocksize to get a bit of recent history, and
make sure
# we are at the beginning of a line.
- sysseek($$logs{$file}{fh}, -$blocksize, 2);
- my $bytes = 0;
- my $str = '';
- do {
- $bytes = sysread($$logs{$file}{fh}, $str, 1);
- } while ($bytes > 0 and $str != '\n');
+ if (sysseek($$logs{$file}{fh}, -$blocksize, 2)) {
+ my $bytes = 0;
+ my $str = '';
+ do {
+ $bytes = sysread($$logs{$file}{fh}, $str, 1);
+ } while ($bytes > 0 and $str != '\n');
+ }
}
$delay = 0 if getfromfile($$logs{$file});
Thanks for a very helpfull tool.
Regards,
Bernd
--
Bernd Holzinger
No emails please