Bash script for monitoring logs based upon last update time - bash

I have a directory on a RHEL 6 server where logs are being written as below. As you can see there are 4 logs already written within 1 minute. I just want to write a script which can check in every 15 minute (Cron ) & if log files are not updating then send an email alert like " Adapter is in hang status, Restart Required". I know basic linux commands & knowledge of crons. This is how i am trying
-rw-r--r-- 1 root root 11M Oct 6 00:32 Adapter.log.3
-rw-r--r-- 1 root root 11M Oct 6 00:32 Adapter.log.2
-rw-r--r-- 1 root root 10M Oct 6 00:32 Adapter.log.1
-rw-r--r-- 1 root root 6.3M Oct 6 00:32 Adapter.log
$ ll Adapter.log >/tmp/test.txt
$ cat test.txt | awk '{print $6,$7,$8}'
Oct 6 03:10
Now how can i get the time of same log file after 15 minutes, so that i can compare the time difference and write a script to send the alert.

Given description, looks like you timestamp can be checked every 15 minutes.
If file was updated in last 15 minutes, do nothing
If file was updated 15 to 30 minutes ago, send email alert
If file was updated 30 minutes ago, do nothing, as error was already reported on previous cycle
Consider placing the following into cron, on 15 minute interval:
find /path/to/log/Adapter.log* -mmin +15 -mmin -30 | xargs -L1 send-alert
This solution will work on most situations. However, it's worth noting that if the system load is very high, cron execution may be delayed, impacting the age test. In those cases, extra file to store the last test time is needed.

Related

how to get the status in dry run on rsync command

Use case - Compare all the files and directories on the mounts ( /apps , /logs , etc ) and calculate which one is the latest and size differences.
I am trying with rsync command , but with the limitation I am not achieving exactly what I need.
Under /tmp/test_ram I created two directories as dir1 and dir2. I have created two files under dir1 as shown below .
drwxr-xr-x 2 chada users 4096 Nov 21 12:03 dir2
drwxr-xr-x 2 chada users 4096 Nov 21 12:03 dir1
cd dir1 ; ls -ltr
total 196
-rw-r--r-- 1 chada users 188510 Nov 21 12:03 file_man_rsync
-rw-r--r-- 1 chada users 6854 Nov 21 12:04 file_man_diff
With DryRun –
I see nothing is happening which is expected, but in the o/p size is showing as zero. Which is not I was expecting, I want to see a size in diff of files.
rsync -n -avrczP --out-format="%t %f %''b" --backup --backup-dir=/tmp/test_ram /tmp/test_ram/dir1/ /tmp/test_ram/dir2/
sending incremental file list
2018/11/21 12:04:55 tmp/test_ram/dir1/. 0
2018/11/21 12:04:55 tmp/test_ram/dir1/file_man_diff 0
2018/11/21 12:04:55 tmp/test_ram/dir1/file_man_rsync 0
sent 161 bytes received 25 bytes 372.00 bytes/sec
total size is 195,364 speedup is 1,050.34 (DRY RUN)
the actual run :
I see the file size is showing up, which is what expected. But I cannot take chance in copying without checking. Yes I do have backup dir, but still it need too much of analysis .
rsync -avrczP --out-format="%t %f %''b" --backup --backup-dir=/tmp/test_ram/dir3 /tmp/test_ram/dir1/ /tmp/test_ram/dir2/
2018/11/21 12:05:52 tmp/test_ram/dir1/. 0
file_man_diff
6,854 100% 0.00kB/s 0:00:00 (xfr#1, to-chk=1/3)
2018/11/21 12:05:52 tmp/test_ram/dir1/file_man_diff 2.48K
file_man_rsync
188,510 100% 16.34MB/s 0:00:00 (xfr#2, to-chk=0/3)
2018/11/21 12:05:52 tmp/test_ram/dir1/file_man_rsync 56.28K
sent 58,915 bytes received 57 bytes 117,944.00 bytes/sec
total size is 195,364 speedup is 3.31
This is an example I took to depict . But my comparision would be between multiple servers.
The mount points can be same , but the files are directories is what I needed to compare.
your help is much appreciated.

Recursively searching a directory without changing directory atimes

I'm checking an alternative to 'find' command in shell scripting so as to eliminate the discrepancy of Accessed date of sub directories.
According to my observation, when find command is executed to list all the files in a directory, the accessed date of sub-directories is getting changed.
I want to post genuine statistics in one of the junk platforms, So I have been looking at some forums and got the alternative with 'ls' command. But that doesn't completely fulfill my request.
Below is the answer given by #ghostdog74.
ls -R %path% | awk '/:$/&&f{s=$0;f=0} /:$/&&!f{sub(/:$/,"");s=$0;f=1;next} NF&&f{ print s"/"$0 }'.
But this finds only the files inside the sub directories. I need all the files and sub-directories' files to be listed.
For example:
bash-3.2# pwd
/Users/manojkapalavai/Desktop/SleepTimeReport
bash-3.2# ls
**6th floor** manoj17 manoj26.txt manoj36 manoj45.txt manoj55 manoj70.txt manoj80 manoj9.txt **test1**
manoj14 manoj23.txt manoj33 manoj42.txt manoj52 manoj61.txt manoj71 manoj80.txt manoj90 **test2**.
The highlighted ones are sub-directories inside "SleepTimeReport" directory and remaining are just files. So, when I execute the above command, I get only the below output.
bash-3.2# ls -R ~/Desktop/SleepTimeReport | awk '/:$/&&f{s=$0;f=0} /:$/&&!f{sub(/:$/,"");s=$0;f=1;next} NF&&f{ print s"/"$0 }'.
~/Desktop/SleepTimeReport/6th floor/Script to increase the Sleep Time.numbers.
~/Desktop/SleepTimeReport/6th floor/Zone1Sleep.pages.
~/Desktop/SleepTimeReport/test1/New_folder.
~/Desktop/SleepTimeReport/test1/manoj.txt.
~/Desktop/SleepTimeReport/test1/sathish.txt.
~/Desktop/SleepTimeReport/test1/vara.txt.
~/Desktop/SleepTimeReport/test1/New_folder/Script to increase the Sleep Time.numbers.
~/Desktop/SleepTimeReport/test1/New_folder/Zone1Sleep.pages.
i.e.; only those files inside sub-directories are listed.
Brief explanation of what issue I'm facing, please see below
Manojs-MacBook-Pro:SleepTimeReport manojkapalavai$ ls -l
total 16
drwxr-xr-x 8 manojkapalavai staff 272 Sep 14 15:07 6th floor
-rwxr-xr-x 1 manojkapalavai staff 59 Nov 13 10:41 AltrFind.sh
-rw-r--r-- 1 manojkapalavai staff 0 Nov 2 15:15 manoj%.txt
-rw-r--r-- 1 manojkapalavai staff 0 Nov 2 18:23 manoj1
When I try finding Created time and Accessed Time of the folder 6th floor before using 'find' command, the below is output.
Manojs-MacBook-Pro:SleepTimeReport manojkapalavai$ stat -f '%N, %SB, %Sa' 6th\ floor/
6th floor/, Sep 13 10:34:55 2017, **Nov 13 11:21:33 2017**
Manojs-MacBook-Pro:SleepTimeReport manojkapalavai$ find /Users/manojkapalavai/Desktop/SleepTimeReport/
/Users/manojkapalavai/Desktop/SleepTimeReport/
/Users/manojkapalavai/Desktop/SleepTimeReport//6th floor
/Users/manojkapalavai/Desktop/SleepTimeReport//6th floor/.DS_Store
/Users/manojkapalavai/Desktop/SleepTimeReport//6th floor/Script to increase the Sleep Time.numbers
/Users/manojkapalavai/Desktop/SleepTimeReport//6th floor/Zone1Sleep.pages
Now, after finding all the files inside a directory, below is the output of atime. you can notice the change
Manojs-MacBook-Pro:SleepTimeReport manojkapalavai$ stat -f '%N, %SB, %Sa' 6th\ floor/
6th floor/, Sep 13 10:34:55 2017, **Nov 13 14:26:03 2017**
All tha I have done is just find the files, and atime of sub-folders inside a folder when we find is getting changed to that current time.
Is there any way to solve this?
ls is the wrong tool for programmatic use. Generally, you should be able to fix your find usage to not have an effect on atimes (actually, it's pretty rare for folks to even have atimes enabled at the filesystem level on modern production systems), but if you really want to avoid it, consider the bash globstar option:
shopt -s globstar
for file in **/*; do
echo "Doing whatever with $file"
done

Unix - pipeline ls - la | less C executable giving double total file size vs shell

*Edit - Stephen has answered this question in the comments below *
so basically I have made two seperate child processes(using two seperate methods with their own fork) to execute the command ls -la | less using pipe.
The first one executes ls like this:
execl("/bin/ls", "ls", "-la", NULL);
The second child process executes less like this:
execlp("less", "less", NULL);
And the results come up fine.. apart from one little part:
Results using shell command:
total 15
drwxr-xr-x 2 daniel staff 4 2015-02-27 18:58 .
drwxr-xr-x 15 daniel staff 24 2015-02-27 18:58 ..
-rwxr-xr-x 1 daniel staff 9280 2015-02-27 18:58 pipes
-rw-r--r-- 1 daniel staff 1419 2015-02-27 18:58 pipes.c
Results using my executable:
total 30
drwxr-xr-x 2 daniel staff 4 Feb 27 18:58 .
drwxr-xr-x 15 daniel staff 24 Feb 27 18:58 ..
-rwxr-xr-x 1 daniel staff 9280 Feb 27 18:58 pipes
-rw-r--r-- 1 daniel staff 1419 Feb 27 18:58 pipes.c
Now the date being a different format I don't care about.. but the total size is twice as large with my executable(30 vs 15). Why is this happening?
Make sure that the ls you are running from the shell and the ls that is running in your program are the same program.
Your program is specifying /bin/ls as the program to run; you can find out what is being run when you type the command at the shell prompt by using the shell command which ls (also see type ls).
If these are different it could be due to the POSIX vs. GNU blocksize used in the total size computation.
This answer indicates that POSIX and GNU tools differ in the blocksize they use to compute the total. Try adding h to your command and compare the results (this flag makes the units explicit). My guess is that the execution environment of these processes is disturbing the result. For instance it may not be the same ls that you are running.

Use newsyslog to rotate log files, but only if they have a certain size

I'm on OS X 10.9.4 and trying to use newsyslog to rotate my app development log files.
More specifically, I want to rotate the files daily but only if they are not empty (newsyslog writes one or two lines to every logfile it rotates, so let's say I only want to rotate logs that are at least 1kb).
I created a file /etc/newsyslog.d/code.conf:
# logfilename [owner:group] mode count size when flags [/pid_file] [sig_num]
/Users/manuel/code/**/log/*.log manuel:staff 644 7 1 $D0 GN
The way I understand the man page for the configuration file is that size and when conditions should work in combination, so logfiles should be rotated every night at midnight only if they are 1kb or larger.
Unfortunately this is not what happens. The log files are rotated every night, no matter if they only the rotation message from newsyslog or anything else:
~/code/myapp/log (master) $ ls
total 32
drwxr-xr-x 6 manuel staff 204B Aug 8 00:17 .
drwxr-xr-x 22 manuel staff 748B Jul 25 14:56 ..
-rw-r--r-- 1 manuel staff 64B Aug 8 00:17 development.log
-rw-r--r-- 1 manuel staff 153B Aug 8 00:17 development.log.0
~/code/myapp/log (master) $ cat development.log
Aug 8 00:17:41 localhost newsyslog[81858]: logfile turned over
~/code/myapp/log (master) $ cat development.log.0
Aug 7 00:45:17 Manuels-MacBook-Pro newsyslog[34434]: logfile turned over due to size>1K
Aug 8 00:17:41 localhost newsyslog[81858]: logfile turned over
Any tips on how to get this working would be appreciated!
What you're looking for (rotate files daily unless they haven't logged anything) isn't possible using newsyslog. The man page you referenced doesn't say anything about size and when being combined other than to say that if when isn't specified, than it is as-if only size was specified. The reality is that the log is rotated when either condition is met. If the utility is like its FreeBSD counterpart, it won't rotate logs less than 512 bytes in size unless the binary flag is set.
MacOS' newer replacement for newsyslog, ASL, also doesn't have the behavior you desire. As far as I know, the only utility which has this is logrotate using its notifempty configuration option. You can install logrotate on your Mac using Homebrew

How to make mkdir make folders in the order I type them, and not have them show up alphabetized

In terminal, I want to make a bunch of folders appear in a certain order. It isn't alphabetical, but in an unrelated order. When I do this:
mkdir this folder is going to be
The folders all show up correctly in Finder, but alphabetized. I have confirmed that the folder's view options are set to Sort By: None, Arrange By: None.
Is there a different way to accomplish this?
If you really want "no order" you will get unpredictable results. Seems like you want file creation date or file modification date (oldest first) order.
This command:
$mkdir this folder is going to be
is misleading, because you have no idea what algorithm 'mkdir' is using internally to create the folders (unless you read the source), so no idea what order is actually going to result, from the point of view of the filesystem (its not the order you expect).
To be clearer, you need to issue the command once per file
$ mkdir this
$ mkdir folder
$ mkdir is
$ mkdir going
$ mkdir to
$ mkdir be
then you can list in reverse modified-date order:
$ ls -tr
this folder is going to be
$ ls -ltr
total 0
drwxr-xr-x 2 user staff 68 6 Jan 20:41 this
drwxr-xr-x 2 user staff 68 6 Jan 20:41 folder
drwxr-xr-x 2 user staff 68 6 Jan 20:41 is
drwxr-xr-x 2 user staff 68 6 Jan 20:41 going
drwxr-xr-x 2 user staff 68 6 Jan 20:41 to
drwxr-xr-x 2 user staff 68 6 Jan 20:41 be
on the native mac filesystem hfs+ there is also a 'creation date' flag, which is probably what you want, but this is not very portable across other filesystems.
IN the finder, arrange by > date created
or arrange by > none, view in list view, with 'date created' column showing, and click on it.
You can't; folders are inherently not ordered.

Resources