Parse a file for certain new entries 1

[TSch]

Hi folks,

another task ahead of me:

I'd like to constantly monitor the /var/log/messages file for new (!) and only for new entries containing the word "ERROR".

One idea was starting with "tail".

e.g.

tail -f | grep ERROR

However the problem starts, when I'm trying to find a way to send an email containing the whole ERROR line as soon as an error occurs ...

Could you give me some brainstorming on how to proceed ?

Regards,
Thomas

 

[Annihilannic]

Bit of a coincidence, I'm writing a tool to do something very similar at the moment! In my case it's to filter out meaningless junk that we can't otherwise disable.

Here is the skeleton I'm using:

[COLOR=#006600]#!/usr/bin/perl -w[/color]

[COLOR=#0000FF]use[/color] strict;

[COLOR=#FF0000]open[/color] MESSAGES, [COLOR=#808080]"< /var/log/messages"[/color] [COLOR=#FF8000]or[/color] [COLOR=#FF0000]die[/color];
[COLOR=#006600]# seek to end of file[/color]
[COLOR=#FF0000]seek[/color] MESSAGES,[COLOR=#FF0000]0[/color],[COLOR=#FF0000]2[/color];

[COLOR=#0000FF]my[/color] $prevsize=[COLOR=#FF0000]0[/color];

[COLOR=#0000FF]while[/color]([COLOR=#FF0000]1[/color]) {

    LINE: [COLOR=#0000FF]while[/color] (<MESSAGES>) {

        [COLOR=#0000FF]if[/color] (/ERROR/) {
            [COLOR=#FF0000]print[/color] [COLOR=#808080]"ERROR message encountered: $_"[/color];

            [COLOR=#006600]# insert code to send email here[/color]
        }

    }
    [COLOR=#FF0000]sleep[/color] [COLOR=#FF0000]1[/color];

    [COLOR=#006600]# Clear EOF flag, rewind to beginning if file has been truncated[/color]
    [COLOR=#0000FF]my[/color] ($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size,$atime,$mtime,$ctime,$blksize,$blocks) = [COLOR=#FF0000]stat[/color](MESSAGES);
    [COLOR=#FF0000]seek[/color](MESSAGES,[COLOR=#FF0000]0[/color],$size < $prevsize ? [COLOR=#FF0000]0[/color] : [COLOR=#FF0000]1[/color]);
    $prevsize=$size;

}

[COLOR=#FF0000]close[/color] MESSAGES;

Annihilannic.

 

[TSch]

Perfect !!!
That's exactly what I was looking for

Thanks a lot !