. . . . but after just a handfull of lines, say two or three, i would want it to stop emailing. I'll cron it every minute but then I don't want it to keep sending me alerts after 3 or 4 events since i'll know already.

i know that find can do this:

find <some path> -type f -name <some log name> -mmin -300 -exec grep <some string> {} \;

the -mmin parameter would be so after some minutes I wouldn't get kept being emailed.

. . . . can grep do this without find? so after greping so many instances of the string, i wouldn't want it to keep emailing me since i'll be doing thing cron every minute. again, an email a minute would be too much. and i'd want to do it every minute since i'd like to know soonest.

chris

that looks strange for me. the log files will contain the info regardless of the find command. grep will also find those lines. So you need to restrict grep to find only the latest lines. We would need some info about those lines to help you further

. . . . . well if the event has not happened yet, grep won't find it though. I ack your find comment though.

If the log recs are timestamped, you'd keep track of that, otherwise you'd have to count the lines in the file and allow for logfile reset ie start a new shorter file.


Don't keep firing up a new process env every minute, its a load on the system and unnecessary. Write a daemon and have it loop every minute. This also makes tracking easier, because you can keep the info in memory.
You might want to keep latest 'mark' in a small file in case you need to restart the daemon.

There is a tool called logtail that does that. It may work similar to the "logtail" from the (way) older logcheck package.

Apart from that I'd urge the OP to curb his wheel re-invention urges as it's not like tools incorporating functionality like that don't exist already...

what about something like this :

grep -q somestring some.log && mail -s 'found alert' joeblow@abc.com </dev/null

then i'd cron job it every few minutes.

this would only email when finding the string but it would keep emailing until string was not in the log anymore.

chris

Actually, when I need this ability, I use http://search.cpan.org/~mgrabnar/Fil...0.99.3/Tail.pm which does the log file tail and you can add the emailing etc.
Needs basic Perl knowledge.

My previous answer was more general about the issues involved.

I know, I just grafted my reply onto your text as it was the latest reply then. Nothing else intended or implicated.

Sure; no worries