Shell Programming and Scripting

Hello,
I am trying to create an iptables script with tail ,sed and awk.

1st Request: Search keyword "secret" in access.log file
2nd Request: Get first column matching lines (ip address)
3rd Request: Save it to a file

This is what I did so far:

grep.sh

Code:

#!/bin/bash
while true;
do
tail -f /var/log/apache2/access.log | awk '{print $1}' 
#tail -f /var/log/apache2/access.log | grep --line-buffered secret | awk '/secret/' | awk '{print $1}'     #not working as expected
#tail -f /var/log/apache2/access.log | grep --line-buffered debug | awk '$1' > ip.txt                          #gives all lines but not column1
#echo "iptables -A INPUT -s "$1" -j DROP" >> black
#echo "$A" >> black
#chmod 755 black
#./black
done

It prints out all ip address but not searching for the keyword "secret".
When I clear shebang symbol existing at the beginning of the following lines, it does not print matching output.

Is it possible to assign the pipe output to a variable so that I can use that value in following steps for iptables command?

Thanks
Boris

Code:

tail -f /var/log/apache2/access.log | awk '/secret/{print $1}'

Hello baris35,

If you want to continuously read the lines and search for a string and put that's matched line's first field to an output_file then following may help you too in same.

Code:

tail -f /var/log/apache2/access.log | awk '/TEST1/{print $1 >> "Output_file"}'

When you are done with tailing the logs(You could come out of above command) then you could check the file named Output_file for matched logs.

NOTE: In above command you could change search string from TEST1to your required text.

Thanks,
R. Singh

I'm confused. People seem to be ignoring the tail -f flag in the pipelines in this code. Note that the command:

Code:

tail -f /var/log/apache2/access.log | awk '{print $1}'

will run forever. No command following this in your script will ever be executed.

If you want to took at the current contents of the log (instead of looking at the current and future contents of the log), use:

Code:

awk '{print $1}' /var/log/apache2/access.log

With tail -f, you don't need (or want) a while true loop, but you need to combine all of the tail and awk pipelines into a single pipeline (not in a loop).

Regarding the while true loop, are you concerned that the log file might be rotated/aged/re-written/whatever? If so, does your version of tail have the -F or --retry flags? These will keep looking for the file if it becomes inaccessible, so you keep reading the new log files that are created by normal ageing processes.

The alternate would be that you would have to have some way to terminate your tail and then restart it, all within the while true loop.


Can you put this code into context as to why you have written it like this so far. I'm sure we can help you to find a solution.



Kind regards,
Robin

Hello,
Thanks for your answers. In comply with your suggestions, I changed the script as shown below:

Code:

#!/bin/bash
#while true;                                                               ----removed according to your suggestions
#do                                                                           ----removed according to your suggestions
prefix="/sbin/iptables -A INPUT -s "
tail -f /var/log/apache2/access.log | awk '/debug/{print $1 >> "ip2"}' | awk '!a[$0]++' ip2 >> ip | echo "$prefix$ip" > fail2ban_ip | sed -e 's/$/ \
-p tcp -dports 80 -j DROP/' -i fail2ban_ip > block | chmod 755 block | ./block

It did not give an output. Then I tested below from command line, I see that it's giving just an empty file. I checked access.log and I saw searched word in latest lines.

tail -f /var/log/apache2/access.log | awk '/debug/{print $1 >> "ip2"}'

Output file ip2 is empty.
I will keep searching a solution for this

Thanks
Boris

You don't seem to understand the concept of a pipeline. In a pipeline, the standard output from the first command in the pipeline becomes the standard input to the second command in the pipeline. If there are more than two commands in the pipeline, the output from every command in the pipeline but the last become the standards input for the next command in the pipeline. And all stages in the pipeline are free to run asynchronously as long as each command reading from its standard input has data to read and each process writing data to the next element of the pipeline is still there to read from the pipe. But in your pipeline:

Code:

tail -f /var/log/apache2/access.log |
  awk '/debug/{print $1 >> "ip2"}' |
  awk '!a[$0]++' ip2 >> ip |
  echo "$prefix$ip" > fail2ban_ip |
  sed -e 's/$/ -p tcp -dports 80 -j DROP/' -i fail2ban_ip > block |
  chmod 755 block |
  ./block

The first awk command writes nothing to standard output. The second awk does not read anything from its standard input. (It reads from a file named ip2 which might or might not exist when that awk tries to open it since it is being created asynchronously by the previous awk. If the file does exist, there is a good chance that it will be processed by the 2nd awk before the 1st awk adds anything to it.) And, the second awk creates a file named ip, but does not write anything to the next stage of the pipeline, but that may be OK because echo never reads from its standard input. Note also that the variable ip which is being passed to echo is not defined by this script. And, since the output from echo is directed to a file, again nothing is written to the standard input of the next stage of the pipeline. But, again, that may be OK because sed when given a filename operand does not read from its standard input. And, sed when invoked with a -i option either gives you a syntax error for an unrecognized option or updates its input file in place. In either of these cases sed writes nothing to its standard output, so the file created by the redirection of standard output from sed will be an empty file. Then we have the next stage of the pipeline (chmod 755 block) which neither reads from standard input nor writes to standard output. And, finally, we have the last stage of the pipeline (./block) which either executes an empty file (if the chmod completed before this stage starts) or fails because it is not executable (if the file hadn't been created yet, or had been created but had not yet been made executable).

I don't know what you are trying to do with this pipeline, but there are so many different concurrent operations going on here with nothing to guarantee that they happen in the proper sequence that the actual behavior will vary considerably depending on what shell you use to run this script, what operating system you use to run this script, the number of other processes that are running on the system when you run this script, and the phase of the moon.

I don't have an apache2 access log file to look at, so I have no idea what is in some of the data you seem to be trying to extract from records in that file. And, you haven't really given us an explanation of what you are trying to do with this script. Without a much better description of what you're trying to do and a sample log file to use as a test case, I don't see how I can help you.