Syslog monitoring script

spidertux1 · 01-09-2013, 01:11 PM

Hi All,

I intend to create a syslog errors monitoring script where it does:
1. capture all error messages
2. running every 5 minutes
3. It won't go to line number 1 or repeating line.

Any clue or help must appreciate

Thanks

TB0ne · 01-09-2013, 03:05 PM

Quote:

Originally Posted by spidertux1

Hi All,
I intend to create a syslog errors monitoring script where it does:
1. capture all error messages
2. running every 5 minutes
3. It won't go to line number 1 or repeating line.

Any clue or help must appreciate

Install and configure logwatch...that's what it does, and it's already written, and probably in your online repositories.

spidertux1 · 01-09-2013, 09:47 PM

Hi TBOne,

Thanks you for your reply.
Our server are majority is hpux therefore I would like to create a script.
Actually I have created one but I'm not so sure how to make second second does not coming back to line 1.

#!/bin/sh

log=/var/adm/syslog/syslog.log
c1=1
c2=`cat $log | wc -l`

if [c1 -ne c2]
then
awk -v c1=1 -v c2=$c2 'NR>=c1 && NR<=c2 { print $0 }' $log `| grep -i error | while read line ; do echo $line | ssh -i /home/spidertux1/.ssh/id_rsa id_rsa spidertux1@XX.XX.XX.XX 'logger'; done
fi

Any comment, suggestion or recommendation will much appreciate?

TB0ne · 01-10-2013, 08:41 AM

Quote:

Originally Posted by spidertux1

Hi TBOne,
Thanks you for your reply. Our server are majority is hpux therefore I would like to create a script.

You didn't mention that at first.

Quote:

Actually I have created one but I'm not so sure how to make second second does not coming back to line 1.

Code:

#!/bin/sh

log=/var/adm/syslog/syslog.log
c1=1
c2=`cat $log | wc -l`

if [c1 -ne c2] 
then 
	awk -v c1=1 -v c2=$c2 'NR>=c1 && NR<=c2 { print $0 }' $log `| grep -i error | while read line ; do echo $line | ssh -i /home/spidertux1/.ssh/id_rsa id_rsa spidertux1@XX.XX.XX.XX 'logger'; done 
fi

Any comment, suggestion or recommendation will much appreciate?

Yes...install logwatch on HPUX. Download the source, and install it. All you'll be doing is re-inventing the wheel.
http://sourceforge.net/projects/logwatch/files/

If you really want to go for a bash solution, something like this might work:

Code:

#/bin/bash
tail -F /var/log/messages|while read LINE;do 
case line in 
    "Error1")
        mail command to send $LINE to whatever ;;
    "Error2")
        mail command to send $LINE to whatever ;;
    "Error3")
         mail command to send $LINE to whatever ;;
esac
done

Modify as needed. This reads new lines going in to whatever log file you specify, and searches them for patterns.

unSpawn · 01-10-2013, 09:00 AM

Quote:

Originally Posted by TB0ne

Yes...install logwatch on HPUX. Download the source, and install it. All you'll be doing is re-inventing the wheel.

I agree.

More importantly spidertux1, you're simply not able to capture and anticipate all warnings and errors with your simple script. So if you're going to script it yourself anyway you make yourself responsible for any missed warnings you could have acted on if only you would have run the right tool.

spidertux1 · 01-10-2013, 08:12 PM

Hi TB0ne & unSpawn,

Thank you so much for your reply. I will consider logwatch