topic Re: Get lines out of /var/mail/root in Operating System - Linux

Get lines out of /var/mail/root

Coolmar — Tue, 12 Sep 2006 07:09:08 GMT

Hi,

I have a whole bunch of emails come in each morning. I need to get the first and last line (date stamp and what cron job ran) out of each message. The problem is that /var/mail/root turns out to be one big file rather than all seperate messages, how you see them with "elm". Is there a way to do this?

Thanks

Re: Get lines out of /var/mail/root

Steven E. Protter — Tue, 12 Sep 2006 07:18:22 GMT

Shalom Sally,

You merely type elm at the command prompt of an HP-9000 system. Assuming root mail is not diverted elsewhere by /etc/aliases this will let you view what you need.

You can also install qpopper from the Internet Express kit and read the mail into your outlook mail reader if you are unfortunate enough to use windows.

SEP

Re: Get lines out of /var/mail/root

Peter Godron — Tue, 12 Sep 2006 07:18:24 GMT

Sally,
can't you use /var/adm/cron/log ?

Re: Get lines out of /var/mail/root

spex — Tue, 12 Sep 2006 07:21:00 GMT

Sally,

See /var/adm/cron/log.

PCS

Re: Get lines out of /var/mail/root

Geoff Wild — Tue, 12 Sep 2006 07:22:34 GMT

Why not have root mail forwarded to your email?

In /etc/mail/aliases

root: sdevine
sdevine: sdevine@yourdomain.com

Then run: newaliases

Rgds...Geoff

Re: Get lines out of /var/mail/root

Pete Randall — Tue, 12 Sep 2006 07:23:49 GMT

You're going to need to use sed to print the line before and the line after the "From" line:

# print 1 line of context before and after regexp, with line number
# indicating where the regexp occurred (similar to "grep -A1 -B1")
sed -n -e '/regexp/{=;x;1!p;g;$!N;p;D;}' -e h

From "Handy One-Liners For Sed" (attached).

Pete

Re: Get lines out of /var/mail/root

Coolmar — Tue, 12 Sep 2006 08:57:02 GMT

The cron log shows some of them but not all of them. There are many lines that show the date/time stamp but not the script that ran.

Re: Get lines out of /var/mail/root

Pete Randall — Tue, 12 Sep 2006 09:16:10 GMT

Actually, as long as the last line is somewhat consistent, you could probably just use grep. For example, all our jobs run from the /apps directory, so the last line is going to contain "apps". In this case all you would need to do is run something like this:

grep -e From -e apps /var/mail/informix |grep -v "From:"

Pete

Re: Get lines out of /var/mail/root

Coolmar — Tue, 12 Sep 2006 09:22:59 GMT

Plus the cron/log looks like the timestamp is when it starts...I need the finish time.

Re: Get lines out of /var/mail/root

Pete Randall — Tue, 12 Sep 2006 09:26:56 GMT

By grepping from /var/mail file, you get the time when the email was sent which should be the finish time. The only trick is catching the last line of the email: easy if you run every thing from one directory and only slightly more complicated if there are multiple directories. Here's my sample output:

grep -e From -e apps /var/mail/informix |grep -v "From:"
From root Tue Sep 12 09:28:19 EDT 2006
/apps/hols/bin/hh/cleanUp.ksh

If there are multiple source directories, you can simply add them with multiple "-e" entries.

Pete

Re: Get lines out of /var/mail/root

spex — Tue, 12 Sep 2006 09:27:50 GMT

Sally,

A single cron job is logged to /var/adm/cron/log in this format:

> CMD:
>
<

For example:

> CMD: /home/root/filecleanup.sh > /dev/null
> root 2328 c Sat Jul 29 19:10:00 EDT 2006
... Other entries ...
< root 2328 c Sat Jul 29 19:12:57 EDT 2006

To find the end time for any job, just match the pid to the start time.

PCS

Re: Get lines out of /var/mail/root

Doug O'Leary — Tue, 12 Sep 2006 09:44:37 GMT

Hey;

Interesting idea for a script - so I wrote it :)!

#!/usr/bin/perl

=cut
###############################################################
bad_crons: Attempts to ID cron jobs that are sending mail to root
Created based on an idea from itrc.
Author: Doug O'Leary
Created: 09/12/06
###############################################################
=cut

use strict;
my $last = '';
my $first = '';
my $subj = '';

my $mail_file = "/var/mail/root";
open (In, "< $mail_file") || die "Can't read $mail_file - ($!)";
while ()
{ next if (/^\s*$/);
chomp;
switch:
{ if (/^From root/)
{ printf("%-30s %s\n", $first, $last)
if (length($first) > 0 && length($subj) > 0);
($first) = $_ =~ m{from root[^\s]* (.*)}i;
$subj = '';
last switch;
}
if (/^Subject:\s+cron$/)
{ $subj = 'cron'; last switch; }
$last = $_;
}
}
close In;

sample output using one of my problem systems:
Mon Sep 11 08:02:01 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 09:02:01 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 10:02:00 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 11:02:00 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 12:02:00 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 13:02:00 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 14:02:01 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 14:02:01 EDT 2006 /usr/contrib/bin/secfile.sh
Mon Sep 11 14:02:01 EDT 2006 /usr/contrib/bin/secfile.sh
Mon Sep 11 16:02:00 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 18:02:01 EDT 2006 /usr/contrib/bin/check_root
Tue Sep 12 01:02:00 EDT 2006 /usr/contrib/bin/check_root
Tue Sep 12 02:20:10 EDT 2006 /usr/local/bin/scanlog
Tue Sep 12 03:35:02 EDT 2006 /usr/local/bin/cleanall -r
Tue Sep 12 04:02:01 EDT 2006 /usr/contrib/bin/check_root
Tue Sep 12 05:02:01 EDT 2006 /usr/contrib/bin/check_root
Tue Sep 12 07:02:00 EDT 2006 /usr/contrib/bin/check_root

HTH;

Doug