On Thu, Jul 22, 2021 at 9:23 AM Stuart Henderson <s...@spacehopper.org> wrote: > > On 2021/07/21 22:55, Sven F. wrote: > > I'm not interested in disk file parsing. > > I run this on a device without storage , hence the use of the project > > front page, > > read from stdin. > > It's not as nice as feeding on stdin, but you can use syslogd's > memory buffer feature. Set e.g. :64:authlog instead of the filename in > syslog.conf, run syslogd with -s /var/run/syslogd.sock, and use > LOGREADER="/usr/sbin/syslogc -f logname". > > However do note, you can only run one copy of syslogc at a time. If you > try to run a second, the first will exit. And it appears that sshguard > will itself exit if LOGREADER exits. So don't use this if you want to > use memory buffer logs for something else as well. >
Yes, thank you, I ' m using them for other purposes so it's a bit annoying :-( i have other ways to do it, the easier way would be to put /var/log in a MFS but the sshguard difference was the ability to read on stdin... What will happen is probably use the regexp script from somewhere else, moreover the program is looping randomly in sched and no one seems to care... bad sign -- -- --------------------------------------------------------------------------------------------------------------------- Knowing is not enough; we must apply. Willing is not enough; we must do
