Emergency UNIX and Linux Support

Hi All,

I have a requirement as below

I need find for a string in a log file and once i found that string i need to send a mail.Thsi can be done thru grep and mailx cmnd.

Here once i found the string i need to send last 50 lines(up) from where string found.

Actually they require to find out the user name which may be available before 50 lines.

One more thing this script will run every 15 min , i am thinking how to handle if there are multiple cases of these failures

any thoughts or code will be appreciated

Thanks
San

1. grepping 50 lines after match.

Code:

grep -A 50 'PATTERN' file

2. For a script to be executed every 15 minutes.

You can use cron, and the cron job should be

Code:

*/15 * * * * CMD

I think he wants the lines before the pattern - grep -B 'pattern', assuming he has GNU grep (linux)

Code:

awk 'BEGIN{tail=50}
{
  a[NR%tail]=$0
}
/pattern/{ for(i=NR+1;i<=NR+tail;i++)print a[i%tail]}
' file

A more efficient way would be to tail and follow the log with "tail -f", store the last 50 lines and email those lines when the failure word occurs. This can be done in either shell, awk or perl easily. An untested gawk version:

Code:

tail -f log-file |gawk '
BEGIN { email_cmd = "mail -s failure emails_addrs" }
{
  line[NR%50] = $0
}
/failure word/ {
  for (i = NR-49; i <= NR; i++)
    print line[i%50] | email_cmd
  close(email_cmd)
}'

I was going to suggest binlib's solution, above, although the standard "tail -f" command might not work after a log rotation. The tail from GNU's coreutils will follow the file opened, not the name of the file, unless you do:

Code:

  tail --follow=filename

But given that you want the most recent occurrence of a pattern before a second pattern occurs, try this (again, gawk or nawk or mawk):

Code:

tail --follow=log-file | awk '
    BEGIN { email_cmd = "mail -s failure emails_addrs" }
    BEGIN { last_found = "NOT AVAILABLE"; last_lineno = 0; }
    /username pattern/ {  last_found = $0; last_lineno = FNR; }
    /failure word/  { print "Found " (FNR-last_lineno) " lines ago:" last_found | email_cmd }'

You'll need to put your own stuff where you see italicized words

Hi All,

Thanks for ur suggestions.Sorry for late reply
I followed otheus suggestion and put the code, but it going to infinite loop and not getting any output. I am new to UNIX, so i may be wrong in some pattern.
Code i am using

#!/bin/sh
tail -f EssbaseLog.txt | awk '
BEGIN { email_cmd = "mail -s failure xxxxx@yyy.com" }
BEGIN { last_found = "NOT AVAILABLE"; last_lineno = 0; }
/[hyperion]/ { last_found = $0; last_lineno = FNR; }
/Error -- not connected/ { print "Found " (FNR-last_lineno) " lines ago:" last_found }'


I have questions on this, as i mentioned if i get error at 2:30 PM, my script will execute and send a report to users.It should also save a text file with that 50 lines for reference.

Then if it runs again on 2:45 it will again send the same error message and it will continue to send the error until log was corrected.

Is there any way we can send only updated errors?

Sorry for amny questions

Any suggestions will be appreciated

Thanks