I have a Dnsmasq server, on which I want to parse query logs to be able to build stats based on queries / responses.
The Dnsmasq provides two logging mechanisms:
- By default, it logs to syslog
- If a path is given, it logs into the file found at the given path
If dnsmasq is logging into syslog
Is there a clean way to "watch" syslog to receive every new line sent by dnsmasq?
If dnsmasq is logging to a file
Would a fifo be a proper solution for dnsmasq logging proxying?
Some issues arise with a fifo created by mkfifo
:
- If we don't want dnsmasq's death to kill the reader process, we need to have another, dummy, process holding a write FD, which is a pain to "automate".
- If we don't want the reader process' death to break the fifo logging, we need another, dummy, reader process that will just ignore every content.
- We need to make sure at all times that the fifo stays up and available.
- If we still want to have dnsmasq's logs, which we probably do, we are forced to either write a custom
/var/log/dnsmasq.log
file or somehow send logs to syslog while disguising ourselves as dnsmasq.
In short
If one wants to properly be notified on new Dnsmasq query / answer without risking interrupting the default dnsmasq mechanisms or adding too much complexity, what would be the best approach?