LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (http://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   can output of tail be redirected? (http://www.linuxquestions.org/questions/linux-newbie-8/can-output-of-tail-be-redirected-438231/)

dsids 04-24-2006 01:54 AM

can output of tail be redirected?
 
Hi Everyone, Can the output of tail be redirected while it is running.... For example......if I do


$tail

.....Then can I compare a particular string in the output of tail to another string written in a shell script

Thanks
Danish

LMAC 04-24-2006 02:11 AM

Well to do that you probally have to store the second string as a variable and do a compare with the tail output... well just compare two variables.

Agrouf 04-24-2006 09:29 AM

yes, you can

kriton12 04-24-2006 11:38 AM

Yes. If you are using bash try an example like this:

#!/bin/bash

stuff=$(tail -1 /var/log/messages)
echo $stuff

(note you will probably need to run this as root since /var/log/messages is most likely not readable by everybody. Just substitute your text file and path for /var/log/messages).

This will save the output of the tail command into the variable stuff. From there you can use whatever technique you want to parse your string.

dsids 04-24-2006 11:50 PM

Yes we can save the output to a variable, but then that is if I do
#tail -1
But I want to do
#tail -f
and then mail the administrator of the system whenever a particular string appears

Thanks
Danish

Wim Sturkenboom 04-25-2006 03:30 AM

You can redirect to a file
Code:

tail -f logfile > otherfile
Or you can pipe it to grep
Code:

tail -f logfile | grep mysearchstring
In the second example, you can check the result of grep and take decisions based on that.
'tail -f' will not work in the second example as tail will never end, so the code has to change to something like:
Code:

#!/bin/sh
if tail -100 /var/log/apache/error_log |grep -i willempie; then
  echo OK
fi


timmeke 04-25-2006 05:15 AM

Using Wim Sturkenboom's script and running it regularly (ie each 5 minutes for fast changing log) via crontab
may indeed be a solution.

If you don't want that, you can also write your own shell script that does
an infinite number of reads, until stdin is closed (read fails).

The algorithm would be something like:
while(1)
{
$a=read();
if (read_failed)
{
break loop;
)
if ( a matches string )
{
send mail
}
}

dsids 04-25-2006 05:57 AM

Yes very true,
tail -f logfile does'nt run in a bash script

If i store the output of $tail -f logfile in a file, say X, and then compare a string written in a bash script to a string in X,
I think the output would somewhat be what I want....

But I wanted to know can't we do

$tail -f logfile | mail ab@xy.com

Thanks
Danish

kriton12 04-25-2006 09:16 AM

Yes, I'm pretty sure you could do that direct

tail -f logfile | mail -s "subjectline" email@address

The only problem is that I'm not sure if the -f option in tail ever lets it end, in which case you need to decide when you want to mail the output because the mail command needs an EOF to signal it to send the mail. So as Sturkenboom says, either give it a --lines=### or --byte=### option (-n and -c respectively) so that it knows when to send instead of -f.

This is what I think I would do...

tail -$(wc -l /path/to/logfile | gawk '{print$1}') | mail -s "subjec" email@address

First it finds the number of lines in the logfile by using 'wc -l' which is then piped to gawk to parse the output.. of which you only want the first piece. This basically gives you the number of lines in the logfile which is substituted as the number of lines argument in the tail command, so just the tail -$(wc -l /path/to/logfile | gawk '{print$1}') piece prints out all the lines of the log file using the tail command. That output is then mailed to the email address.

But now that I think about it, isn't this just a fancy way of saying:

cat logfile | mail email@addressDOTcom

?

What exactly do you want to do, have the output emailed to you each time it is updated? You may want to use cron or even tripwire to do that instead. Otherwise I guess you could write a bash script that wakes up every minute or so, checks the file with the diff command and if something changes, email the changes or the entire contents of the file.

dsids 04-25-2006 11:58 PM

I do understand that mail@someonesaddress.com would need an EOF to execute and that tail -f does not provide that...Although I have thought of an idea, but it requires two scripts to be made and ideally I dont want that....

What I had in my mind was...
$tail -f /logfile >> logfile1.txt

1) then as the data in logfile1.txt would change every now and then

2)I would write a bash script which has a variable containing a paricular string and then this particular string is then matched with the current last line in logfile1.txt.....

3)As soon as the bash script finds a match in logfile1.txt a mail would be sent to xyw.com containing that particular string

Thanks
Danish

timmeke 04-26-2006 01:39 AM

Have you looked at
man logrotate ?

Logfile rotation is pretty standard stuff and can include mailing the log to someone.
Maybe there's an option (ie via scripting) to mail only if the log has a certain string.

Wim Sturkenboom 04-26-2006 03:16 AM

Using 'tail -f /logfile >> log1.txt' seems pretty useless to me.

But I think that we have all ingredients to create a solution. I really enjoyed building the following. As I'm not a bash scripter, I learned a lot.
Code:

#!/bin/sh

# file and searchstring
myfile="testfile.txt"
mysearchstring="mutex"
# loop delay
mydelay=5

# initial number of lines in file
result1=$(wc -l $myfile | awk '{print $1}')

# loop forever; I don't know another way
i=1
while [ $i -eq 1 ] ; do
    # get new number of lines and calculate difference
    result2=$(wc -l $myfile | awk '{print $1}')
    difference=$(($result2-$result1))
    # if different
    if [ $difference -gt 0 ] ; then
        # send mail
        tail -$difference $myfile |grep $mysearchstring |mail -s test root
        # reset initial result to current number of lines
        result1=$result2;
    fi

    sleep $mydelay
done

Some flaws:
1)
each entry in the log must start on a new line
2)
concurrency; if the logfile is updated by the application after wc is executed by the script but before the script executes the tail, you might miss some lines
3)
if logfile is deleted or manually made smaller, script has to be restarted !!

Flaw 3 can be fixed in the code, I guess you have sufficient info now. Also, you can add code to send the initial log when the script is started (or restarted).

dsids 05-02-2006 11:44 PM

Thanks I do appriciate the help that you all are giving but its kind of becoming messier..Im still a newbie and Ive just joined office on probation as a trainee So its tough trying to cope up with different kinds of information....I think the script that I want will take a lot of deep understanding by me..Sadly I have to leave it here. But thank you all for helping me...
And Wim Sturkenboom..I was not able to get the correct ouput by runnning your script...I tried understanding it but I think it required more attention from me but sadly Im not able to give that....

Thank you all
Danish

chrism01 05-03-2006 01:42 AM

If you can come back with more details sometime, we'll be able to help you better.

dsids 05-03-2006 01:57 AM

Thanks..Ill surely come back when Im better..Meanwhile Ill continue posting the small problems that I have

Danish


All times are GMT -5. The time now is 04:23 PM.