rsync/support/logfilter

#!/usr/bin/perl
# Filter the rsync daemon log messages by module name.  The log file can be
# in either syslog format or rsync's own log-file format.  Note that the
# MODULE_NAME parameter is used in a regular-expression match in order to
# allow regex wildcards to be used.  You can also limit the output by
# directory hierarchy in a module.  Examples:
#
#  logfilter foo /var/log/rsyncd.log   # output lines for module foo
#  logfilter foo/dir /var/log/syslog   # limit lines to those in dir of foo

use strict;

my $match = shift;
die "Usage: logfilter MODULE_NAME [LOGFILE ...]\n" unless defined $match;

my $syslog_prefix = '\w\w\w +\d+ \d\d:\d\d:\d\d \S+ rsyncd';
my $rsyncd_prefix = '\d\d\d\d/\d\d/\d\d \d\d:\d\d:\d\d ';

my %pids;

while (<>) {
    my($pid,$msg) = /^(?:$syslog_prefix|$rsyncd_prefix)\[(\d+)\]:? (.*)/o;
    next unless defined $pid;
    my($mod_spec) = $msg =~ /^rsync (?:on|to) (\S+) from /;
    if (defined $mod_spec) {
	if ($mod_spec =~ /^$match(\/\S*)?$/o) {
	    $pids{$pid} = 1;
	} else {
	    delete $pids{$pid};
	}
    }
    next unless $pids{$pid};
    print $_;
}