UNIX for Dummies Questions & Answers

tail -f /var/log/foo | grep "Can not load CRL"  >capture-file

#!/usr/bin/env ksh


logf=$1                 # log file to suss; supplied as parameter on cmd line
pat=$2                  # pattern to search log for
this=${0##*/}           # base name of script
lastf=/tmp/$this.data   # file where we tuck our last found line away for next time

if [[ -z $logf || -z $pat ]]        # error if logfile name or pattern isn't supplied
then
    echo "usage: $0 log-file-name pattern"
    exit 1
fi

if [[ ! -s $lastf ]]    # no last run data; must check all lines from log
then
    need_all=1          # this will cause us to check for pattern straight away
fi

# parse the log file writing, to stdout, any matches that haven't been seen yet
# The last line seen is written to the last data file for next time.
#
awk  -v snarf=$need_all -v lastf=$lastf -v pat=$pat '
    BEGIN {
        if( !snarf )                # not in check all mode, must find last data
        {
            getline < lastf;
            last_data = $0;
            close( lastf );
        }
    }

    snarf {                         # need all, or found the last line from prev run
        if( match( $0, pat ) )      # if it contains the pattern, print it to stdout
            print;
        new_last = $0;              # save the last line we saw
        next;                       # go to next input line (skip remaining awk code)
    }

    {       # not snarfing yet, check to see if this is the last line we saw before
        snarf = $0 == last_data;    # start snarfing if it matches
        # tricky way of saying:
        # if( $0 == last_data)
        #     snarf = 1;
    }

    END {
        if( new_last )
            printf( "%s\n", new_last) >lastf;   # save our last observed line in the data file.
    }
' <$logf

exit $?           # return the exit code that awk returned with