Alert noise suppression fails when awk scripts target /dev/stderr

Direct answer

Stop writing to /dev/stderr. The portable way to send alert text to standard error from awk is to pipe it to a shell command that redirects to file descriptor 2:

print "ALERT: threshold exceeded" | "cat 1>&2"
close("cat 1>&2")

This works because the redirection happens in the shell that awk spawns, not inside awk itself. For syslog, invoke logger via system(), but treat it as an optional external utility.

Why /dev/stderr fails

POSIX awk does not define /dev/stderr as a special path. gawk documents it, but mawk and busybox awk may treat it as an ordinary filename, open it in the current directory, or fail silently. When the path is unrecognized, the write either lands on stdout or creates a stray file, which is exactly the noise you are seeing.

Normalizing system() exit codes

POSIX specifies that system() returns the exit status shifted left by eight bits. Some awk variants use different encodings. The safe rule is:

1. Treat any non-zero return as failure.
2. If you need the numeric exit code, compute int(status / 256).
3. If the child was killed by a signal, the low byte is non-zero and the quotient is zero; still classify that as failure.

status = system("logger -t myapp \"disk almost full\"")
if (status != 0) {
  exit_code = int(status / 256)
  # handle failure; do not assume success
}

Portable feature set

When targeting gawk, mawk, and busybox awk together, assume only POSIX awk. Do not rely on IGNORECASE, PROCINFO, BEGINFILE, ENDFILE, gensub(), or /dev/stderr. For case-insensitive pattern matching, normalize input with tolower() or toupper() and match against a normalized literal.

Verification

Confirm the pipe approach on each target awk by separating the streams:

awk 'BEGIN { print "data" ; print "alert" | "cat 1>&2" }' > out.txt 2> err.txt

Check that out.txt contains only data and err.txt contains only alert. Before deploying syslog alerts, verify the logger binary exists:

command -v logger

If it is absent, either fall back to the cat 1>&2 pipe or write to a local alert file that your monitoring wrapper tails.

Assumptions and uncertainty

This assumes a POSIX-compatible shell is available to awk for coprocesses. The system() encoding described above follows POSIX; some historical or embedded awk builds may differ, which is why the non-zero check must come before arithmetic extraction. If your environment cannot guarantee logger, confirm whether a local-file fallback is acceptable; that determines whether the syslog path is viable or whether stderr piping should be the only delivery mechanism.