SNMP::Server::Logtail - Tails logfiles and presents counters via SNMP

 #!/usr/bin/perl
 use SNMP::Server::Logtail;

 sub exim_mainlog {
   my($hash, $line)=@_;
   $hash->{MSG_IN}++ if /^<= /;
   $hash->{MSG_OUT}++ if /^=> /;
   # etc
 }

 snmpd_init( -logfile => '/tmp/testlog',
	     -prefix => '.1.3.6.1.4.1.2021.255' );
 add_oidmap( MSG_IN => 1,
	     MSG_OUT => 2 );
 add_logfile('/var/log/exim/mainlog' => \&exim_mainlog);
 snmpd_run();

 pass_persist .1.3.6.1.4.1.2021.255 /path/to/script.pl

 snmpget -v 1 -c public localhost .1.3.6.1.4.1.2021.255.1

#!/usr/bin/env perl
# -*- mode: perl; coding: iso-8859-1 -*-
# Author: Peter Corlett
# Contact: abuse@cabal.org.uk
# Revision: $Revision$
# Date: $Date$
# Copyright: (c) 2005 Peter Corlett - All Rights Reserved

package SNMP::Server::Logtail;
require v5.8.1;			# need 5.8.1 for reliable threads
use strict;
use vars qw( $VERSION @ISA @EXPORT );
# $Id: Logtail.pm 35 2005-09-27 13:27:28Z abuse $
$VERSION = do { my @r=(q$Revision: 35 $=~/\d+/g); sprintf "%d."."%03d"x$#r,@r };
@EXPORT=qw( snmpd_init add_oidmap add_logfile snmpd_run );
@ISA=qw( Exporter );

use threads;
use threads::shared;

use CGI::Carp qw(set_progname);
use Data::Dumper;
require Exporter;

# This hash contains the counters for various events
my %counter;
share %counter;

my $stop=0;
share $stop;

my %oidmap;
my %oidnext;

my $running;
my @threads;

my $prefix;

sub snmpd_init {
  my(%opts)=@_;

  my $logfile=$opts{-logfile};
  croak "-logfile not set" unless defined $logfile;
  $prefix=$opts{-prefix};
  croak "-prefix not set" unless defined $prefix;
  my $logname=$opts{-logname} || $0;

  open STDERR, '>>', $logfile
    or croak "Can't create/append $logfile: $!";

  set_progname("${logname}[$$]");
  $running++;
  warn "Started\n";
  $|=1;
}

sub END {
  warn "Crashed!\n"
    if $running;
}

sub add_oidmap {
  %oidmap=(%oidmap, reverse @_);

  my @oids=sort {$a<=>$b} keys %oidmap;
  $oidnext{''}=$oids[0];
  foreach(1..$#oids) {
    $oidnext{$oids[$_-1]}=$oids[$_];
  }
}

sub run_monitor {
  my($logname, $subref)=@_;
  warn "Starting monitoring $logname\n";
  my $first=1;
  until($stop) {
    open LOG, '<', $logname
      or croak "Can't open $logname: $!";
    my($curinode, $cursize)=(stat LOG)[(1, 7)];
    if($first) {
      # If this is the first run (i.e. the logfile hasn't been rotate
      # on us) we seek to the end of the file and start tailing from
      # there. This is so that all the previous entries in the logfile
      # don't appear all at once and be potentially graphed as
      # happening in the last moment.
      seek LOG, 2, 0;
      $first=0;
    }
    my $rotated=0;
    until($rotated || $stop) {
      my($newinode, $newsize)=(stat $logname)[(1, 7)];
      while(my $line=<LOG>) {
	lock %counter;
	&{$subref}(\%counter, $line);
	#print "\033[H\033[J", Dumper \%counter, scalar localtime;
	last if $stop;
      }
      sleep 1;
      # has logfile been rotated?
      if(defined $newinode && (
			       $newinode != $curinode # file has been rotated
			       || $newsize < $cursize # file has been truncated
			      )
	) {
	$rotated=1;
	warn "Log rotated, will reopen $logname\n";
      }
    }
  }
  warn "Stopped monitoring $logname\n";
}

sub add_logfile {
  my($logname, $subref)=@_;
  my $thread=threads->create('run_monitor', $logname, $subref);
  push @threads, $thread;
}

sub snmpd_run {
  while (my $command=<STDIN>) {
    chomp $command;
    if ($command=~/^PING/){
      #warn "Answering snmpd PING\n" if $DEBUG;
      print "PONG\n";
      next;
    }
    my $oid=<>;
    chomp $oid;
    my($suffix)=$oid=~/^$prefix\.?(.*)$/o;
    $suffix='' unless defined $suffix;
    if ($command eq "getnext") {
      #warn "Answering getnext for suffix $suffix\n" if $DEBUG;
      if(exists $oidnext{$suffix}) {
	$suffix=$oidnext{$suffix};
      } else {
	$suffix='NONE';
      }
    }
    #warn "Answering get for suffix $suffix\n" if $DEBUG;
    if(exists $oidmap{$suffix}) {
      lock %counter;
      my $value=$counter{$oidmap{$suffix}} || 0;
      $value &= 0xffffffff;
      print "$prefix.$suffix\ncounter\n$value\n";
    } else {
      print "NONE\n";
    }
  }

  warn "Shutting down...\n";
  $stop=1;
  $_->join foreach @threads;
  warn "Stopped\n";
  $running=0;
}

  
1;