script to check log file....

[boblucci]

hey guys,

i need help writing a script to check a log file and then e-mail the output to me.

so far is have this:

#!/bin/bash
less /var/log/file.log | grep smbd*

ok, i want every line that starts with smbd from the file.log to be mailed to me. When i run this on the command line it works right but i'm stuck at geting it mailed to me.

how do i do that? i have to direct it somewhere right?

I want to run this as a cron job to run every hour.

[demian]

You can do something like this:
{
echo "To: You I guess <you@yourdomain.com>"
echo "From: deamon <root@yourbox.com>"
echo "Subject: Whatever"

grep smbd /var/log/file.log #why use less when you already use grep?
}|exim -bm your_addy@your_domain.com

(or pipe it to sendmail -t if that's what you use)

However, why re-invent the wheel? There are tons of logcheckers out there that do a very good job and don't just blindly mail you stuff a certain daemon spit out (though they can be configured to do that). I use logcheck myself as one means to monitor our servers. Try it.

[boblucci]

[quote author=demian link=board=9;threadid=8156;start=0#msg74172 date=1069282037]
You can do something like this:
{
echo "To: You I guess <you@yourdomain.com>"
echo "From: deamon <root@yourbox.com>"
echo "Subject: Whatever"
[/quote]

thats what i was thinking of

grep smbd /var/log/file.log #why use less when you already use grep?
}|exim -bm your_addy@your_domain.com

(or pipe it to sendmail -t if that's what you use)

Mostly because i dont know what i'm doing.

However, why re-invent the wheel? There are tons of logcheckers out there that do a very good job and don't just blindly mail you stuff a certain daemon spit out (though they can be configured to do that). I use logcheck myself as one means to monitor our servers. Try it.

i do use logcheck but i just wanted something quick and dirty the check a change i made to samba.

I didnt even think about making logcheck run every hour, i have it running once a day now, i just wanted something i could stick in cron for a couple of hours, thats all.

[Schotty]

Just shooting ideas out there; I used to do admin work as you recall (or not), and the method I used was several xterms all running various ssh sessions. I had ntop, logfile tails, firewall tails. I had one of each for 4 boxes. I ened up REALLY loving fluxbox (group tabs and name them) and totally getting a boner over shit like tabbed kterm/gnome-terminal. Makes alot better use of screen real-estate.

I am assuming your box is using log rotation of some sort, in the morning review the previous day and just fire up a tail of the log current ... day/file/whatever.

Anyhoo, thats what I did; it worked great for ME. I have no idea if it works well for you or not.