HELP - Shell Scripting Problem

[morgaann]

Hi there,

If there is anyone out there who is good at bourne shell scripting in solaris then I need your help.

I need to write a scipt that will scan a log file looking for a particular message and if it finds the message it spawns off another scipt.

My scripting skills are VERY limited and any help would be appreciated

Thanks.

 

[tarn]

Ok you would need to give example of your log file and what you wanted to call if a key word was found, BUT the outline of what I would (and have in the past) do is:

tail -f /path/to/logfile.log | grep "keyword" > /tmp/alert.log &

This tail/grep command will run in the background (because of the &) and if the "keyword is encountered it will be written into /tmp/alert.log .... Ok so that the first stage .....

Now what I would then do is write a little script to be run by cron every minute or so to check the /tmp/alert.log to see taht it was empty and if NOT then we need to kick off the other script (or in my case an email alert) and clear out the /tmp/alert.log ready for the next error/alert to be trapped!

Ok so does that help ?

One of my old csh scripts went something like this:

#!/bin/csh
foreach ALERTLOG ( /tmp/alert.log )
grep "ORA-" "$ALERTLOG" >& /dev/null
if ($status < 1 ) then
echo &quot;An entry has been captured in $ALERTLOG indicating an Oracle ERROR&quot;|mail -s &quot;Alert from `hostname`&quot; oracle@localhost
cat /dev/null > &quot;$ALERTLOG&quot;
endif
end

Good Luck,
Laurie

 

[morgaann]

Thanks Laurie.

To be more specific about the log. If you are familiar with Legato Networker then you would know of a log file called the daemon.log. What I am trying to capture from this file is whenever a tape becomes full it writes to this log something like this;

&quot;media notice: dlt7000 tape abc.123 on /dev/rmt/1ubn if full&quot;

I need to capture that message and parse out the name of the tape that I need to feed to the scipt that's to be spawned off. The other issue with this daemon.log file is it doesn't write one file for each day, so I need to make sure that the message I am capturing is from the last 24 hours.

Thanks for any help you can provide

 

[bluedragon2]

Just a suggestion since I do not know Legato:

Can you edit the file that generates the log message to also run a script when it generates that log instead of monitoring the log file?

 

[tarn]

Ok bear with me (no I dont know Legato either, allthough I guess it's time I did), but in the mean time take a look and maybe do a search on the Legato forum here ->

http://www.tek-tips.com/threadminder.cfm?SPID=480

And I'll be back when I've thought abought it, I guess that there is not a problem with switching between bourne and csh on your system ?

It's just that I use whatever works for what I'm trying to do (and usually it can be converted to work in either).

If you find anything on the Legato forum pop it back here so I dont waste my time re-inventing the wheel &quot;please&quot;

Laurie.

 

[morgaann]

Thanks.

I took a quick look at the Legato forum and didn't find anything. I will try and post this question in that Forum and let you know if I get anywhere.

 

[tarn]

Ok carefull with double posting as they get a bit narked if you dont keep them both in step ( I mean that you need to say that its closed or you have fixed it in another forum &quot;if you have&quot or people like me who hop between forums think &quot;but hey! I thought I answered that one allready!!&quot;


Cheers
Laurie.

 

[tarn]

Ok very simplistic but lets assume that you know two things:
1) The error that you want to trap is &quot;allways in the format of&quot; that string that you posted ...
media notice: dlt7000 tape abc.123 on /dev/rmt/1ubn is full
media notice: dlt7000 tape gby.123 on /dev/rmt/6ubn is full
media notice: dlt7000 tape abc.123 on /dev/rmt/1ubn is full
media notice: dlt7000 tape yxz.999 on /dev/rmt/2ubn is full

It has 8 fields per &quot;Error&quot; record ... stick with me ...

2) And each &quot;Error&quot; ends in &quot;is full&quot; you had &quot;if full&quot; I'll guess it's a typo ... anyway..

With a file of (to awk) records like this we could easly do a simple awk to get field 5 ($5) for the tape number like so: (assume that we have a number of errors in teh daemon.log and the result from the following grep is, the file error.log now has the four records as above as its contents):

grep &quot;is full$&quot; daemon.log > error.log; awk '{print &quot;your tape No: is &quot;$5}' error.log

The results are:
your tape No: is abc.123
your tape No: is gby.123
your tape No: is abc.123
your tape No: is yxz.999

Ok, so grep looked for lines in the daemon.log that had &quot;is full&quot; at the end of the line using the EOL marker($) and squirted them into error.log .... in reality we would do a tail -f | grep &quot;is full$&quot; daemon.log > error.log so we would have only one error in error.log at any time

We need to move these errors into another file otherwise as you say we would keep finding the same error if we looked at daemon.log over and over .... the tail -f pipe will (with the help of grep) trap &quot;NEW&quot; errors as they are written to the daemon.log and of course pass them into error.log

Now, assuming we know the format of the error log we will know that field 5 is the &quot;name of the tape&quot;? correct? .... so we just to awk the error.log at intervals to get the value of $5 and pass that into a vairable to use with the command you need to run your script that you mention in your earlyer posting > parse out the name of the tape that I need to feed to the scipt that's to be spawned off.

So to put it all together we should:
1)tail -f daemon.log | grep &quot;is full$&quot; > /tmp/error.log &
2)run a script at an interval that contains something like:

#!/bin/sh
tapeNo=`awk '{print $5}' /tmp/error.log`
if ($tapeNo != &quot;&quot;
then
/path/to/your/script/name.sh $tapeNo
echo &quot;This tape $tapeNo number was found to be full and has been passed to my re-run script on `date`&quot; >> /tmp/results.log
cat /dev/null > /tmp/error.log
fi

Phew time for bed I think .... questions in the morning please ZZZZZzzzzzzzzzzzzzzz

Laurie.

 

[pmurray99]

Where in the log is the date stamp for each message?

Does &quot;media notice:&quot; always indicate an error has occurred?

Suggest you post a fragment of the log that includes errors as well as warnings and info messages.