Log search and mail it if the log is updated before 24 hours from the current time


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Log search and mail it if the log is updated before 24 hours from the current time
# 8  
Old 07-12-2013
Quote:
Originally Posted by Kalaihari
Am so happy for the above explanations dude,, Thanks a lot for spending your valuable time for answering this question and doubts... Smilie
You're welcome Smilie.
Here's an improved, fully commented version of the script:
Code:
#!/bin/bash

################################################################################
# AUTHOR: Gabriel A. Cánepa / Twitter: @gacanepa
# CREATION DATE: July 11, 2013
# LICENSE: GPL v3 or later. See http://www.gnu.org/licenses/gpl.html
# USAGE: 
#	- Create a plain text file (THE FILE) with a list of files to be examined.
#	  For example:
#		ls -ld /var/log/* | grep '^-' | grep 'log$' | awk '{print $9}' > mylogs
#		[List all regular files (grep '^-' looks for a hyphen at the beginning
#		of each line resulting from the output of the ls command) that end in 
#		.log, then prints the 9th field, which is the absolute pathname of each 
#		file (see the -d option of the ls command)]
#	- Chmod it to 700 (or give it adequate permissions)
#	- This script will:
#		* search the word ERROR in the last 100 lines of those files.
#		* if any of those files doesn't exist, or is not a regular file, 
#		  the script will skip it and continue with the next file.
#		* detect whether each file has been updated during the last 24 hours.
#		* send the results via email.
#		* See example: http://i40.tinypic.com/2e5pnjd.png
# MODIFICATION HISTORY:
#	- July 12, 2013: 
#		* Added email header with host information and job date
#		* Added email footer: user executing the script
#		* Replaced THE FILE's relative pathname (mylogs) for its absolute
#		  pathname (/home/gacanepa/stuff/scripts/mylogs), stored in the 
#		  loglist variable, to be able to run the script through cron as well.
################################################################################

mailcontents=mailbody # Auxiliary file that is used to store the contents of the email's body
loglist=/home/gacanepa/stuff/scripts/mylogs # Absolute path to the file that contains the
											# list of files to be examined. This way, the script
											# can be run through cron as well.

# Email header
echo "*****************************************************************" > $mailcontents
echo "*   LOG CHECK - HOST: $HOSTNAME - DATE: $(date +'%A %B %d, %Y')   *" >> $mailcontents
echo "*****************************************************************" >> $mailcontents
echo "" >> $mailcontents
# End email header

while read line
do
	if [ ! -f $line ]; then
		echo "$line doesn't exist or is not a regular file. Continuing with the next file in the list..." >> $mailcontents
		echo "============" >> $mailcontents 
		continue
	else
		last_mod_time=$(stat -c '%Y' $line) # Check the log's last modification time and converts it to Unix epoch
		last_24_hours=$(date +%s -d "24 hours ago") # Return the epoch of (the current timestamp minus 24 hours)

		if [ $last_mod_time -lt $last_24_hours ]; then
			echo "$line has NOT been updated in the last 24 hours" >> $mailcontents
		else
			echo "$line was updated during the last 24 hours" >> $mailcontents
		fi
	
		tail -100 $line > checklog

		error=$(grep ERROR checklog | wc -l) # We look for the lines containing the word "ERROR" in the checklog file.
											 # Then we redirect the output to the wc -l command to count the number
											 # of lines where the word ERROR appears.
	
		if [ $error -gt 0 ]; then # If this condition is satisfied, that means the word ERROR appeared at least once in
								  # the log that's being examined in the current loop.
			echo "ERROR found in $line" >> $mailcontents
			echo -e "\t" $(grep ERROR checklog) >> $mailcontents
		else
			echo "No errors found in $line" >> $mailcontents
		fi
	fi
echo "============" >> $mailcontents
done < $loglist

# Email footer
echo "" >> $mailcontents
echo "This script was executed by $USER on $(date +'%A %B %d, %Y') at $(date +'%H:%M:%S')" >> $mailcontents
# End email footer

if [ -s $mailcontents ]; then
	mail -s "Errors and last modification times - $(date +'%A %B %d, %Y')" myemail@mydomain.com < $mailcontents
fi

rm $mailcontents checklog # Delete auxiliary files when we're done.

If you consider that your question has been answered, please mark this thread as SOLVED for the future reference of other users (Go to "Thread tools" and click on "Mark this thread as solved"), and please click on the "Thanks" link in the bottom right corner of this post.
# 9  
Old 07-13-2013
Hi Gabriel,

I have created a text file by adding the logs and saved it as mylog.txt
Code:
#!/bin/sh
mailcontents=mailbody
while read line
do
    if [ ! -f $line ]; then
        echo "The file $line doesn't exist. Continuing with the next file..." >> $mailcontents
        echo "============" >> $mailcontents 
        continue
    else
        last_mod_time=$(stat -c '%Y' $line) # this line checks the log's last modification time and converts it to Unix's epoch
        last_24_hours=$(date +%s -d "24 hours ago") # this line returns the epoch for the current timestamp minus 24 hours

        if [ $last_mod_time -lt $last_24_hours ]; then
            echo "Log $line has NOT been updated in the last 24 hours" >> $mailcontents
        else
            echo "Log $line was updated during the last 24 hours" >> $mailcontents
        fi
    
        tail -100 $line > mylog.txt

        error=$(grep ERROR mylog.txt | wc -l) # We look for the lines containing the word "ERROR" in the mylog.txt file.
                                             # Then we redirect the output to the wc -l command that will count the number
                                             # of lines where the word ERROR appears.
    
        if [ $error -gt 0 ]; then # If this condition is satisfied, that means the word ERROR appeared at least once in
                                  # the log that's being examined in the current loop.
            echo "ERROR found in log $line" >> $mailcontents
        else
            echo "No errors found in $line" >> $mailcontents
        fi
    fi
echo "============" >> $mailcontents
done < mylogs.txt

if [ -s $mailcontents ]; then
    mail -s "Log errors and last modification times - $(date +'%A %B %d, %Y')" myemail@gmail.com < $mailcontents
fi

rm $mailcontents mylog.txt # Delete auxiliary files when we're done.

This is the script i written to execute the shell to retrieve the logs from mylog.txt

The issues which i faced is
1) Am using AIX terminal for running the script.
2) Am facing issues in date convertion steps

Code:
last_mod_time=$(stat -c '%Y' $line)
last_24_hours=$(date +%s -d "24 hours ago")

The stat -c is not recognized as well as date -d is not recognized on the AIX terminal. Its sending a result like " The logs were not Updated for 24 hours for all the logs as it couldnt recognize/read the dates on the logs.

The only problem is date conversion is there any solution for this to run the shell script (not bash) .. Could you please help me out by modifying the date conversion which would be in a readable format for AIX terminal. Thanks for your patience and thanks in advance

Last edited by Franklin52; 07-14-2013 at 06:03 PM.. Reason: Please use code tags
# 10  
Old 07-13-2013
Hi Hari,
When you post code, you should use code tags Smilie.
You can do this by writing the word "CODE" inside square brackets at the beginning of the code, and at the end "/CODE", also inside square brackets and without quotes.

Quote:
The issues which i faced is
1) Am using AIX terminal for running the script.
2) Am facing issues in date convertion steps

last_mod_time=$(stat -c '%Y' $line)
last_24_hours=$(date +%s -d "24 hours ago")

The stat -c is not recognized as well as date -d is not recognized on the AIX terminal. Its sending a result like " The logs were not Updated for 24 hours for all the logs as it couldnt recognize/read the dates on the logs.

The only problem is date conversion is there any solution for this to run the shell script (not bash) .. Could you please help me out by modifying the date conversion which would be in a readable format for AIX terminal. Thanks for your patience and thanks in advance
I didn't know you were running AIX, but it's OK. Unfortunately, I don't have an AIX box to test an equivalent command Smilie. But take a look at this post or this post and see if it helps. It looks like in AIX there is an istat command. Alternatively you can google something like "Linux stat equivalent in AIX" or the like.

As far as the date format is concerned, you can examine date's man page by typing in your terminal "man date" (without quotes) and choose the format that best suits your needs.

Let me explain further:
Code:
date +%s -d "24 hours ago"

When you run the date command (without options) you get something like:
Code:
gacanepa@Gabriel-PC ~ $ date
Sat Jul 13 21:52:20 WARST 2013

In date's man page for AIX you should find a list of format modifiers. For example, the
Code:
+%s

modifier tells date to convert its output (shown above) to the number of seconds ellapsed since January 1, 1970 (known as Unix epoch).
As to the -d option:
Code:
-d, --date=STRING
              display time described by STRING, not `now'

So what this does is:
Display Unix epoch for the current timestamp minus 24 hours.
I'm pretty sure that you can find an equivalent for AIX. The best of luck!
# 11  
Old 07-16-2013
Hi Gabriel,

Thanks for the post. I tried by editing the code like


last_mod_time=$(date +%s $line) # this line checks the log's last modification time and converts it to Unix's epoch
last_24_hours=$(date "+%Y %m %d_%H %M %S" "24 hours ago") # this line returns the epoch for the current timestamp minus 24 hours


I dont know whether i have did correctly but i think its giving me a wrong update , actually the log was updated in 24 hours gap but am getting mail like the log was not updated. Could you please modify this alone. IF possible and make it run in AIX terminal. Sorry for bothering you again and again
# 12  
Old 07-16-2013
Quote:
Originally Posted by Kalaihari
Hi Gabriel,

Thanks for the post. I tried by editing the code like

Code:
last_mod_time=$(date +%s  $line)  # this line checks the log's last modification time and converts it to Unix's epoch
last_24_hours=$(date "+%Y %m %d_%H %M %S"  "24 hours ago") # this line returns the epoch for the current timestamp minus 24 hours

Unfortunately I don't have an AIX terminal to try Smilie. What I can tell by looking at your script is that you're trying to perform a date conversion using wrong parameters.
Something that just came to my mind is which shells you have installed in your system.
Please post the output of the following commands:
1) echo $SHELL
2) chsh -l
3) cat /etc/shells
Another thing. Did you leave the first line of my script intact? (#!/bin/bash)

---------- Post updated at 04:29 PM ---------- Previous update was at 03:35 PM ----------

Ok. Let's give perl a try Smilie.
Change this:
Code:
last_24_hours=$(date +%s -d "24 hours ago")

with this:
Code:
last_24_hours=$(perl -e 'print time-86400')

---------------
And this:
Code:
last_mod_time=$(stat -c '%Y' $line)

with this:
Code:
last_mod_time=$(perl -MFile::stat -e "print stat('$line')->mtime")

That should do the trick.

I look forward to hearing from you.
# 13  
Old 07-16-2013
Hi Gabriel,

i think your idea worked but am not 100% sure about . When i ran the above perl idea added with the bash script , it din showed me any errors or warnings. Just entered the next line. then i ran sh samp.bash it displayed the below output in my mail

I added a log of mine added with ERROR. Thanks for the script .

The file /var/opt/effi/cron.log doesn't exist. Continuing with the next file...
============
The file /var/opt/effi/Doc_cron.log doesn't exist. Continuing with the next file...
============
The file /var/opt/effi/Call_cron.log doesn't exist. Continuing with the next file...
============
The file /var/opt/effi/RSA_cron.log doesn't exist. Continuing with the next file...
============
The file /var/opt/effi/IAS_cron.log doesn't exist. Continuing with the next file...
============
Log /var/opt/hari.log has NOT been updated in the last 24 hours ERROR found in log /var/opt/hari.log============ The file /opt/IBM/FileNet/AE/Router/ConsumerUnderwriting/CUE_cron.log /opt/IBM/FileNet/AE/Router/ConsumerUnderwriting/BuildDoc/CUBuilDoc_cron.log doesn't exist. Continuing with the next file...
============
The file /var/opt/SSPCall_cron.log doesn't exist. Continuing with the next file...
============
The file /var/opt/RSA_cron.log doesn't exist. Continuing with the next file...
============
The file /var/opt/IAS_cron.log doesn't exist. Continuing with the next file...
============
The file /var/opt/Complete_cron.log doesn't exist. Continuing with the next file...
============
The file /var/opt/Extract_cron.log doesn't exist. Continuing with the next file...
============
The file /var/opt/ExtractContentQ_cron.log doesn't exist. Continuing with the next file...
============
Log /var/opt/hari.log has NOT been updated in the last 24 hours ERROR found in log /var/opt/hari.log
============
The file 1 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 3 doesn't exist. Continuing with the next file...
============
The file 43 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 55 doesn't exist. Continuing with the next file...
============
The file 5 doesn't exist. Continuing with the next file...
============
The file ERROR doesn't exist. Continuing with the next file...
============
The file Error doesn't exist. Continuing with the next file...
============
The file ERROR:Filename doesn't exist. Continuing with the next file...
============
The file error doesn't exist. Continuing with the next file...
============
The file ERROR: I gotcha!! doesn't exist. Continuing with the next file...
============
The file 1 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 3 doesn't exist. Continuing with the next file...
============
The file 43 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 55 doesn't exist. Continuing with the next file...
============
The file 5 doesn't exist. Continuing with the next file...
============
The file ERROR doesn't exist. Continuing with the next file...
============
The file Error doesn't exist. Continuing with the next file...
============
The file ERROR:Filename doesn't exist. Continuing with the next file...
============
The file error doesn't exist. Continuing with the next file...
============
The file ERROR: I gotcha!! doesn't exist. Continuing with the next file...
============
The file 1 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 3 doesn't exist. Continuing with the next file...
============
The file 43 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 55 doesn't exist. Continuing with the next file...
============
The file 5 doesn't exist. Continuing with the next file...
============
The file ERROR doesn't exist. Continuing with the next file...
============
The file Error doesn't exist. Continuing with the next file...
============
The file ERROR:Filename doesn't exist. Continuing with the next file...
============
The file error doesn't exist. Continuing with the next file...
============
The file ERROR: I gotcha!! doesn't exist. Continuing with the next file...
============


I have some thing which needs to be cleared in the above output. I don't want to see these lines.

The file 1 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 3 doesn't exist. Continuing with the next file...
============
The file 43 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 55 doesn't exist. Continuing with the next file...
============
The file 5 doesn't exist. Continuing with the next file...
============
The file ERROR doesn't exist. Continuing with the next file...
============
The file Error doesn't exist. Continuing with the next file...
============
The file ERROR:Filename doesn't exist. Continuing with the next file...
============
The file error doesn't exist. Continuing with the next file...
============
The file ERROR: I gotcha!! doesn't exist. Continuing with the next file...
============
The file 1 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 3 doesn't exist. Continuing with the next file...
============
The file 43 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 55 doesn't exist. Continuing with the next file...
============
The file 5 doesn't exist. Continuing with the next file...
============
The file ERROR doesn't exist. Continuing with the next file...
============
The file Error doesn't exist. Continuing with the next file...
============
The file ERROR:Filename doesn't exist. Continuing with the next file...
============
The file error doesn't exist. Continuing with the next file...
============
The file ERROR: I gotcha!! doesn't exist. Continuing with the next file...
============
The file 1 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 2 doesn't exist. Continuing with the next file...
============
The file 3 doesn't exist. Continuing with the next file...
============
The file 43 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 4 doesn't exist. Continuing with the next file...
============
The file 55 doesn't exist. Continuing with the next file...
============
The file 5 doesn't exist. Continuing with the next file...
============
The file ERROR doesn't exist. Continuing with the next file...
============
The file Error doesn't exist. Continuing with the next file...
============
The file ERROR:Filename doesn't exist. Continuing with the next file...
============
The file error doesn't exist. Continuing with the next file...
============
The file ERROR: I gotcha!! doesn't exist. Continuing with the next file...
============


How to make this cleared to get a perfect output like your sample output :

Subject: Log errors and last modification times - Thursday July 11, 2013
To Gabriel Canepa (Gmail)

Log /var/log/alternatives.log was updated during the last 24 hours
No errors found in /var/log/alternatives.log
==============
The file /my/name/is/slim/shady doesn't exist. Continuing with the next file...
==============
Log /var/log/faillog has NOT been updated in the last 24 hours
No errors found in /var/log/faillog


I dont want to see the lines in my log to be presented in the mail as my output resulted. Smilie
# 14  
Old 07-16-2013
You get all those "File x doesn't exist" messages because you have added all those files in the log list. Other than that, I don't see much of a difference between the results that you got and mine.
Make sure you list only existing logs, and maybe one or two that don't exist. Then examine the output. If it still doesn't look like you wanted, please send me via email your version of the script and the file that you're using to list all the logs.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Log File updated time

hi can any one please help on below .im new to shell scrpting i need to write a shell script which will check particular log file is presented or not in specific location ,if yes how long it was not modified/not rolling ?if its not modified/log is not rolling script will have to send mail (9 Replies)
Discussion started by: 4Learning
9 Replies

2. Shell Programming and Scripting

Search the string in the active log and send mail

Hello, I wanted to search specific string in the acitve log file and send an email if the search string found in the log. Log file is written by application all the time. So, script has to search if any new log entry has the specific string for example " sample exception" and send an email. (1 Reply)
Discussion started by: balareddy
1 Replies

3. Shell Programming and Scripting

Search for logs traced between specific date and time from log file

HI, I want to search for a logs which are trace between specific date and time from logs file. My logs are generated like this :- Tue Jun 18 05:00:02 EEST 2013 | file_check.sh| Message:script has files to process. Thu Jun 20 05:00:02 EEST 2013 | file_check.sh| Message:script has files to... (5 Replies)
Discussion started by: ketanraut
5 Replies

4. Shell Programming and Scripting

awk : Search for text between two time frame (12 hours)

I have created the script to grep the errors from weblogic logs files and redirecting output to file.txt ...From file.txt I'm using awk command to collect the past 20 mins output...The script running from cron every 15 mins... The script working well... Now the challenges, I'm trying to use... (27 Replies)
Discussion started by: zenkarthi
27 Replies

5. Homework & Coursework Questions

Sort current logged in users by log in time (supposedly to be very easy but I'm missing something)

1. The problem statement, all variables and given/known data: Show all users who are currently logged in, sorted from earliest to latest log in time. The log in time includes the month, day, and time. 2. Relevant commands, code, scripts, algorithms: finger, who, sort, pipe, head, tail, ... (8 Replies)
Discussion started by: vtmd
8 Replies

6. UNIX for Dummies Questions & Answers

Adding hours and minutes to current date (Only to date not to time)

Hi, I want to add some hours and minutes to the current date. For example, if the current date is "July 16, 2012 15:20", i want to add 5 hours 30 minutes to "July 16, 2012 00:00" not to "July 16, 2012 15:20". Please help. Thanks! (4 Replies)
Discussion started by: manojgarg
4 Replies

7. Shell Programming and Scripting

How can view log messages between two time frame from /var/log/message or any type of log files

How can view log messages between two time frame from /var/log/message or any type of log files. when logfiles are very big and especially many messages with in few minutes, I would like to display log messages between 5 minute interval. Could you pls give me the command? (1 Reply)
Discussion started by: johnveslin
1 Replies

8. UNIX for Dummies Questions & Answers

Execute crontab for every 4 hours and begin from current time

I want to add a crontab entry which should execute for every 4 hours and that 4 hours calculation should begin from the current time. Normally if I set the crontab entry like this, 00 */4 30 05 * root date >>/tmp/cronout The above will execute the date command for every 4 hours like... (7 Replies)
Discussion started by: Ganeshwari
7 Replies

9. Solaris

files updated in last 10 hours should be moved

Hi, I would like to move all files that are updated in last 10 hrs. to some temporary folder. Please help. (3 Replies)
Discussion started by: sanjay1979
3 Replies

10. Shell Programming and Scripting

shell script not getting current error messages with time from alert.log

Hi All, I need to get current error messages with time from alert.log.Below is my shell script but it's not working to meet this objective. could anyone pls share on the above issue for resolution: #################################################################### ## ckalertlog.sh ##... (2 Replies)
Discussion started by: a1_win
2 Replies
Login or Register to Ask a Question