[SOLVED] Adding a string to the start of a line in linux

casperpache · 11-10-2016, 07:48 AM

Hi all,

Although im not really new to Linux I am still a learner to scripting.

I simply want to add a new location to my /etc/syslog file but I cant figure out the command.

So... I want to add /var/spool/root to my syslog file by using a script (because I want to run this script across multiple servers) to add it in.

My syslog is currently showing as:

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron /var/log/sulog {
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

I want it to include the location /var/spool/root as below:

/var/spool/mail/root /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron /var/log/sulog {
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

I've searched for a way to do this but I cant find anything for this specific scenario.
It needs to be inserted on the 1st line because I believe that's the way the file is read by the logrotate.

Is anyone able to offer some advice please?

Thanks

Dave

TB0ne · 11-10-2016, 08:17 AM

Quote:

Originally Posted by casperpache

Hi all,
Although im not really new to Linux I am still a learner to scripting. I simply want to add a new location to my /etc/syslog file but I cant figure out the command. So... I want to add /var/spool/root to my syslog file by using a script (because I want to run this script across multiple servers) to add it in.

My syslog is currently showing as:

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron /var/log/sulog {
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
I want it to include the location /var/spool/root as below:

/var/spool/mail/root /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron /var/log/sulog {
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

I've searched for a way to do this but I cant find anything for this specific scenario. It needs to be inserted on the 1st line because I believe that's the way the file is read by the logrotate.

If you're familiar with Linux, you must have run across the 'sed' command before, and I'm fairly positive that any web searches you did would have turned it up as well. Also...what have you done/tried on your own so far???? Also...you've asked about scripting in 2011...FIVE YEARS AGO...have you not progressed any in that time?

A simple

Code:

sed -i 's/^\/var\/log\/messages/\/var\/spool\/mairoot \/var\/log\/messages/g'

...works very well. Any research on the sed command would show you the caret '^' indicates a beginning-of-line....so the search/replace looks for a beginning-of-line, followed by /var/log/messages, and replaces it with "/var/spool/mairoot /var/log/messages".

szboardstretcher · 11-10-2016, 08:36 AM

In case you need to run things on multiple hosts now or in the future I would suggest using python 'fabric' which makes it far easier to send commands.

To install on centos 7:

Code:

yum install python-pip python-devel
pip install fabric

A script 'runthis.py' to log in to a host and run the above sed command from tb0ne:

Code:

from fabric.api import *

def athost(ip):
        env.user = 'root'
        with settings(host_string='{0}'.format(ip)):
		run('sed -i "s/^\/var\/log\/messages/\/var\/spool\/mairoot \/var\/log\/messages/g" /etc/syslog')

Command to run this on a host:

Code:

# prompts for password
fab -f runthis.py athost:ip=192.168.100.1

# includes password in command
fab -P somepassword -f runthis.py athost:ip=192.168.100.1

Turbocapitalist · 11-10-2016, 08:39 AM

Yes, "sed" a good way to do it in a script. It's quite flexible. The suggestion above can be made more readable using a different delimiter for the substitution so that the slashes don't have to be escaped.

Code:

sed 's|^/var/log/messages|/var/spool/mailroot /var/log/messages/|' /etc/syslog

So instead of s/// you have s|||. If you prefer, you could use s### or just about anything else as long as they are three of a kind.

TB0ne · 11-10-2016, 08:46 AM

Quote:

Originally Posted by Turbocapitalist

Yes, "sed" a good way to do it in a script. It's quite flexible. The suggestion above can be made more readable using a different delimiter for the substitution so that the slashes don't have to be escaped.

Code:

sed 's|^/var/log/messages|/var/spool/mailroot /var/log/messages/|' /etc/syslog

So instead of s/// you have s|||. If you prefer, you could use s### or just about anything else as long as they are three of a kind.

Nice one....I've always gone 'old-school' and just escaped things with backslashes. Sed has a HUGE amount of flexibility, though...

Turbocapitalist · 11-10-2016, 09:10 AM

Quote:

Originally Posted by TB0ne

I've always gone 'old-school' and just escaped things with backslashes.

Me, too. Though one day I had some hideous pattern with a dozen or so slashes that had to be replaced with something similar. For me that was the turning point on that aspect of "sed". I admire how someone had not only written the code in C for "sed" but come up with the bare idea itself before that in sufficient detail to implement it. GNU "sed" is a re-implementation and so is the BSD version I have elsewhere. The farthest I can trace it online is sed on sourceforge, though there might be something in one of the printed books on the topic.

szboardstretcher · 11-10-2016, 09:39 AM

Nice. I always forget about the delimiter option in sed.

If we are concentrating on making a more readable sed statement rather than how to apply it to multiple server, my submission is:

Code:

# insert /var/log/messages into beginning of first line
# using ; as a delimiter as suggested earlier
sed -i '1s;^;/var/log/messages ;' /etc/syslog

grail · 11-10-2016, 10:06 AM

Not sure if we can assume inserting on the first line (up to OP of course), but a slightly shorter sed would be:

Code:

sed 's;^/var/log/messages;/var/spool/mail/root &;' /etc/syslog

keefaz · 11-10-2016, 10:46 AM

It looks like more of a logrotate than a syslog config file to me

casperpache · 12-13-2016, 03:53 AM

Guys, the response on this was awesome and I really appreciate the time you have taken to assist.

Just a few things...

yes, this is related to the logrotate, it is a new location that we would like to rotate on multiple servers.

My scripting knowledge is unfortunately not very progressive due to my workload of OS and hardware issues... I get the time to quickly provide answers/solutions, but afterwards, not enough time to digest the methods. (Cant believe its been 5 years since I posted the last scripting thread.)
From that, I realise that I really need to learn this via a proper structure to understand it.

SED looks great and although I have heard of it before, i've not really understood its capabilities.

Thanks again, ill mark this as complete as this has set me en-route to my solution..... hopefully my next scripting request will be at a more advanced level.