2

I am looking for a script ( bash / perl / python ) which uppon calling by cron every 5 seconds it will check if new lines were added to my specific log files. If there are any new lines, the script should mail to root the notification containing the log event.

Is there any way that I can accomplish this ?

4 Answers 4

3

You could try out Tenshi. It is written in Perl, very easy to set up and does exactly what you requested. From the Ubuntu package description:

"Tenshi is a log monitoring program, designed to watch one or more log files for lines matching user defined regular expressions and report on the matches. The regular expressions are assigned to queues which have an alert interval and a list of mail recipients."

Ubuntu package (Link), Debian package (Link).

2

This can be done with a bash script which performs the following tasks:

  1. Have a background process monitoring each log file with tail -f, writing the output to a buffer location.
  2. Regularly harvest, act on and truncate the buffer location.

I would use a single script, perhaps launched as in init script, rather than a cron job. For example:

#!/bin/bash

RECIPIENT=root
SUBJECT="Log monitor"
PERIOD=5    # Harvest log buffer every PERIOD seconds

# Prepare the log buffer and ensure it is empty
LOGBUFFER=/tmp/logbuffer.$$
cp /dev/null $LOGBUFFER

# Monitor the log files in the background.
# More than one log file can be specified on the command line.
for file in "$@"; do
    tail -f -n0 "$file" | while read line;do echo "$file: $line";done >> $LOGBUFFER &
done

# Harvest the log buffer
while :;do
    if [ -s $LOGBUFFER ]; then
        mail -t "$RECIPIENT" -s "$SUBJECT" < $LOGBUFFER
        cp /dev/null $LOGBUFFER
    fi
    sleep $PERIOD
done

The script isn't perfect (e.g. it will leave a /tmp/logbuffer.123 file lying around when it exits) but it should get you started.

1

If you would consider switching to using syslog-ng you can configure it to automatically launch a shell script which can trigger an email based on the syslog message pattern. I have this in place for security logging.

0

calling by cron every 5 seconds

Cron doesn't have granularity smaller than minutes. If you want that kind of granularity you'll need incrond. Just have something like:

/var/log IN_CLOSE_WRITE /usr/local/sbin/notify.sh $@/$#

and a script that mails to you:

tail $1 | mail -s "New lines in: $1" root

You might have to play around with the right kinds of events. But this will make it unnecessary to start the script in a timed fashion. If you have the incrontab set up correctly you can be sure that something will have changed whenever the script starts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .