I have written a script, which polls a log file entries last half an hour only and send an email, if error is found.I have scheduled this script to run in crontab for every half an hr.
Below is the script. But this script is not working as I wanted .For ex. if it runs at 11:30 AM, it should scan for the log for duration between 11:00:00 AM to 11:30:00 AM. Instead, it is scanning the file for "00:00" or "30:00" also. I guess, I have made some mistake in applying regular expressions, could anyone help?
blogs=/opt/docs/datapower/prod/business.log
slogs=/opt/docs/datapower/prod/system.log
starttime=$(date +'%H')
currmin=$(date +'%M')
curdate=`date|cut -d' ' -f5`
echo $(date)
if [ $currmin -le 29 ] && [ $starttime -ne 00 ] ; then
starttime1=`echo "$(date +'%H') - 1" | bc`
logtime="$starttime1"
logtime="$logtime:[3-5][0-9]"
echo $logtime
elif [ $currmin -le 29 ] && [ $starttime -eq 00 ] ; then
logtime="23:[3-5][0-9]"
echo $logtime
else
logtime="$starttime"
logtime="$logtime:[0-2][0-9]"
echo $logtime
fi
if ( grep "$logtime" $slogs | egrep "AAA Authentication Failure|AAA Authorization Failure") > dptest 2>&1;then
Do something
fi
Below is the example log entry
Nov 20 06:06:58 business-log-sta [DP-Domain-STAGING][0x80000001][business-log][info] mpgw(GenServiceMPG): trans(31513092)[request]: AAA Authentication failure/>
Your code works on my system, the only problem I was having is that "AAA Authentication Failure" is written with a capital 'F' in your code and a lower case 'f' in your log file.
You can reduce your code too by changing lines like
logtime="$starttime1"
logtime="$logtime:[3-5][0-9]"
to logtime="$starttime1:[3-5][0-9]"
.
Edit: If you want I can supply sample outputs of the script working on my system.
User contributions licensed under CC BY-SA 3.0