#!/bin/ksh
ec=0				# Final exit code.
IAm="${0##*/}"			# Basename of this program.
LOGDIR="/path/to/log/directory"	# Directory containing log files.
LOGFILE="syslog"		# Name of log file.
LOGPAT="[.][2-9][0-9][0-9][0-9][01][0-9][0-3][0-9]-[0-2][0-9]:[0-5][0-9]:[0-5][0-9]"
STATUSFILE="$LOGFILE.spot"	# Status file
TMPF="$IAm.$$"			# Temp file to hold extracted log entries.
Usage="SYNOPSIS
    $IAm [-hr]"			# Synopsis for this program
Help="NAME	$IAm -- Rotate and extract recent entries from log files

$Usage

DESCRIPTION
    The $IAm utility shall process the log file:
	$LOGDIR/$LOGFILE
    in various ways.  With the -r option, the current log file will be renamed
    by appending a timestamp to the end of the log file filename and a new log
    file shall be created.

    When invoked without options, $IAm shall extract log file entries from
    renamed log files and the current log file and mail them to selected
    administrators.  If any renamed log files are present, $IAm shall zip
    those renamed log files after the log entries are extracted.

OPTIONS
   -h	Help.  Print this help message and exit.
   -r	Rotate log files.  If the current log file is not an empty file, the
    	current log file shall be moved to a file with an extension representing
	the current date in the format:
	    $LOGDIR/$LOGFILE.YYYYMMDD-hh:mm:ss

INPUT FILES
    $LOGDIR/$LOGFILE
    	Current log file.

    $LOGDIR/$STATUSFILE
    	$IAm status file.

    $LOGDIR/$LOGFILE.datestamp
    	Old logfile(s).

OUTPUT FILES
    $LOGDIR/$STATUSFILE
    	Update $IAm status file.

    $LOGDIR/$LOGFILE.datestamp.gz
    	Zipped old logfile(s).

EXIT STATUS
    0	Successful commpletion.
    >0	An error occurred.

APPLICATION USAGE
    Note that this application will only work if each entry written to the log
    file is performed as a single write operation and the file descriptor used
    to write those entries is opened (for appending) before an entry is written
    and closed after each entry is written."

# Move to the directory containing the log and status files..
cd "$LOGDIR" || exit 1

# Process command-line arguments...
while getopts hr name
do	case "$name" in
	(h)	printf '%s\n' "$Help"
		exit 0;;
	(r)	if [ -s "$LOGFILE" ]
		then	mv "$LOGFILE" "$LOGFILE.$(date '+%Y%m%d-%T')" &&
			>> "$LOGFILE" || ec=2
		fi
		exit $ec;;
	(?)	printf '%s\n' "$Usage" >&2
		exit 3;;
	esac
done
shift $((OPTIND - 1))
if [ $# -ne 0 ]
then	printf '%s: No operands expected.\n%s\n' "$IAm" "$Usage" >&2
	exit 4
fi

# Get last line number processed from the status file...
if [ ! -r "$STATUSFILE" ]
then	printf '%s: WARNING: Status file not found.  Resetting to line 0.\n' \
	    "$IAm" >&2
	if ! echo 0 > "$STATUSFILE"
	then	printf "$IAm: Can't create status file.  Exiting.\n" "$IAm" >&2
		exit 5
	fi
	last=0
else	read -r last < "$STATUSFILE"
fi

# Get list of unzipped log files to process...
list=( "$LOGFILE"$LOGPAT "$LOGFILE" )
if [ "${list[0]}" = "$LOGFILE$LOGPAT" ]
then	# There are no old log files, reset the list...
	list=( "$LOGFILE" )
fi

# Extract entries added since last run and update status file...
awk -v last="$last" -v StatusFile="$STATUSFILE" '
FNR == 1 && filecount++ {
	# We have found the 1st line in a log file after the 1st log file,
	# reset "last" so we extract all entries from this log file.
	last = 0
}
FNR > last # Extract entries that have not been included in earlier reports.
END {	# Update status file.
	print FNR > StatusFile
}' "${list[@]}" > "$TMPF" || ec=$((ec + 1))

# Compress any uncompressed old log files...
for ((i = $((${#list[@]} - 2)); i >= 0; i--))
do	gzip "${list[$i]}" || ec=$((ec + 1))
done

# Send mail reporting status of this run...
if [ -s "$TMPF" ]
then	subject="New log entries found $(date)"
else	subject="No new log entries found $(date)"
fi
mailx -s "$subject" user@abc.com user2@xyz.cm < "$TMPF" || ec=$((ec + 1))
rm -f "$TMPF"
exit $ec