Question

I am trying to read a constantly changing log file (that is text file) and generate an alert on some text found in that file. I want to do it through bash scripting but I’m confused that how i ll invoke my program as soon as some text comes into that log file.

In other words, how can i keep a check all the time on that file so that whenever some specific text comes into that file, i get alert regarding that text. any function call? or something else? Please advise.

Answer 1

the way i think i would go about it is this:

first of all i will create a bash script and a text file, the bash script will first store the number of lines of that log file in the text file, then add a cron of that script.

the script will count the lines of that file and compare it to the number of lines stored in the text file

you can do that using the command

wc -l filename

if the number of lines is bigger then the log has been updated, i will calculate the current number of lines minus the number stored in the text field, and by that i will know how many lines have been added since last check, then use this command to fetch those lines

tail -n $number_of_lines filename

and i will loop through the output and do the desired action if one of the lines matches your criteria and then update the text file which holds the number of lines, i would have written you the bash script but i guess you got the idea

EDIT: you can execute this script (just write your code which searches for the matches etc)

#!/bin/bash

NUMBER=`/bin/cat ./numberoflines`
LINES=`/usr/bin/wc -l < /var/log/messages`

DIFFERENCE=$(($LINES-$NUMBER))

if [ $DIFFERENCE != 0 ]; then
tail -n $DIFFERENCE /var/log/messages |while read line
do
if $( echo $line | grep --quiet 'New USB device found' )
then
        # Email text/message
        EMAIL='[e-mail]'
        SUBJECT="New USB device found"
        EMAILMESSAGE="/tmp/emailmessage.txt"
        echo "New USB device found etc ..." > $EMAILMESSAGE
        /bin/mail -s "$SUBJECT" "$EMAIL" < $EMAILMESSAGE
fi
done
echo "$LINES" > ./numberoflines
fi

EVEN if you cannot add anything to crons then you still can execute this script anyway, see what you want to match and check and execute the code you need there