Hello Monks! I am trying to batch process syslogs from multiple firewalls in very close to realtime using File::Tail::Multi. Each device writes to its own syslog file, thus my need to have some form of multiple tails. The code is pretty straight forward in the example, but no matter what I push (in terms of syslog) into it, I get errors like this on each and every line:

Invalid conversion in printf: "%P" at ./systail line 89, <GEN0> line 6
+68899.
[download]

Line 89 in my proto-code is a simple:

printf("$line\n");
[download]

The error is actually attached to the line, so it gets passed into the rest of the processing and pretty much wreaks havoc with my regex's etc. Here is a snippet of what I am working with (I changed the actual processing to a simple printf while I am troubleshooting):

###  Set up the multitail handle for our logfiles
$multitail=File::Tail::Multi->new
  (
    Files           => ["$logstring"],
    Debug           => "0",
    Function        => \&ProcessLogs,
    RemoveDuplicate => 0,
  );

for (;;)
{
  $multitail->read;
  sleep 4;
}
exit 0;



###  Log Processing Main Routine
sub ProcessLogs
{
  my $passed=shift;
  foreach my $line ( @{$passed} )
  {
    chomp $line;
    printf("$line\n");
    next if $line=~//;
    if ($line=~/Built/) { printf("Built\n"); }
    elsif ($line=~/Teardown/) { printf("Teardown\n"); }
    elsif ($line=~/Deny/) { printf("Deny\n"); }
  }
}
[download]

Does anyone have any experience with tailing multiple files, or has used File::Tail::Multi that can offer some sage-like wisdom? This seems pretty straight forward, but after commenting out the "next if" line and rewriting this a few different ways, I am kind of lost here. Thank you!

---

---

• Are you posting in the right place? Check out Where do I post X? to know for sure.
• Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:

  <code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>

• Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
• Want more info? How to link or How to display code and escape characters are good places to start.