crontab to send alert only once

[DeafFrog]

Dear Gurus ,

I am monitoring a port , if the number of connection on that port increases to more than one , i intend to send a mail .I intend to schedule this thru crontab , but the mail should go only once , even if the cron tab next run find more process listening on that port.

somethnig like :-
a=`/usr/local/bin/lsof -i tcp:21414 | grep -v "^COMMAND"| wc -l`
if [ $a >1]
then
send mail to this person
fi

---but if this runs thru crontab , and found again 3 process listening it will send the mail again , i want to avoid this second mail .

Please suggest.

Many Thanks in advance.

Regards ,

[James R. Ferguson · Accepted solution]

Hi:

You might record the number of connections in a file or even simply create a file to signify that more than one connection exists. Each time your script runs, test for the presence of the file (or read the number of connections recorded in it) and take the appropriate action.

Regards!

...JRF...

[Steve Post]

a=`/usr/local/bin/lsof -i tcp:21414 | grep -v "^COMMAND"| wc -l`
if [ $a >1 -a ! -f /tmp/mute.button ]
then
send mail to this person
touch /tmp/mute.button
fi

and a second job to run on Mondays, Wednesdays and Fridays?
rm /tmp/mute.button 2>>/dev/null

[DeafFrog]

Hello James and Steve ,
Thanks again.

Steve : why the second job to remove the /tmp/mute.button on
alternate days , and not daily. i want to send mail only once ,
everyday , if more than one process found.

Regards,

[Prasanth V Aravind]

a=`/usr/local/bin/lsof -i tcp:21414 | grep -v "^COMMAND"| wc -l`
if [ $a >1]
then

if test -f /tmp/mail.lock.file
then
echo "do nothing "
else
send mail to this person
touch /tmp/mail.lock.file
fi
else

rm /tmp/mail.lock.file

fi

[Steve Post]

Why Monday, Wednesday, Friday? It actually was just a whim. You said daily. But I figured you didn't want to get bugged on a weekend.

For me, I wouldn't delete the mute button until I got back to work and fixed the problem. Then I would delete it by hand.

But I better not forget about it.

[Steven Schweda]

> But I better not forget about it.

You could have a cron job send you an e-mail
message* if the marker file gets too old.



* Or shut down the system.

[TTr]

How often would you be running the cron job? In the same script you can check the time of day and delete the mute.button every morning or whenever you like. For example if the job is running 8am to 5pm every 5 minutes, you can check if "date +%R" is equal to 08:00 and delete the file before you check for connections.

[Steve Post]

# and delete the mute button if it is over 24 hours
/usr/bin/find /tmp \
-name mute.button \
-mtime +1 \
-type f \
-size 0 \
-exec rm {} \+

[Steve Post]

No wait.... Look at Prasanth's reply. You would want to send a new page if the error went away and came back in under 24 hours.

[Raynald Boucher]

Add a date tag to your flag file name like "touch /tmp/`date '+%y%j`.flag" and then purge the ones older than 2 days?

All kinds of possibilities.

[Denver Osborn]

You could also use current epoch and if the diff between the last alert and current alert are > 86400 secs, clear your lock file and send another alert.

To get the epoch with perl...

perl -e 'print time'

If you're comfortable with perl, write your alert script in perl... if not, then write it in shell and use the perl to set a variable.

here's an example to get you started... you can put this into a function which gets called when your alert condition exists. If the lapse between the current alert and last alert are > 86400 second (24hrs) it can send another alert.

-----

typeset -i ALERTED NOW DIFF LAPSE
LOCK=/tmp/mylock.file # your lock file
LAPSE=86400 # min seconds between alerts
NOW=$(perl -e 'print time')
ALERTED=$(cat ${LOCK} 2>/dev/null)

# diff between last alert time and now
DIFF=$((NOW - ALERTED))

if [ ${DIFF} -gt ${LAPSE} ];then
# send your alert and update lock file
commands to send your alert
echo ${NOW} > ${LOCK}
fi

-----

Hope this helps,
-denver

[DeafFrog]

Hi Steve , Steven , TTr , Raynald and Denver ,

Many thanks for the input ,here's how i am able to manage it as of now,
====================

a=`cat /tmp/value1`
when=`date | cut -c 5-16`
echo $when
echo $a
b=`/usr/local/bin/lsof -i tcp:21414 | grep -v "^COMMAND"| wc -l`
if [ "$a" -lt "$b" ]
then
c=`expr $b - $a`
echo $c
mailx -s"Number of process on 192.168.83.2:21414 has been increased by $c at $when " mathewsml@infinity.hcl.com < /dev/null
a=$b
echo $a > /tmp/value1
elif [ "$a" -gt "$b" ];then
d=`expr $a - $b`
mailx -s"Number of process on 192.168.83.2:21414 has been decreased by $d at $when " mathewsml@infinity.hcl.com < /dev/null
echo $b > /tmp/value1
elif [ "$a" -eq "$b" ]
then
echo $b > /tmp/value1
fi

[Steve Post]

I assume you know this. But maybe not? So here you go.

Here is the $when line rewritten.
when=$(date +"%b %d %H:%M")

I'm only worried about May being a 3 digit month vs 4 digits for June. The %b will give you a 3 digit month.

You could redo it to 17May2010_08:30
when=$(date +"%d%b%Y_%H:%M")

Now even though I picking on a line of your code, It's great. I'd already copied it.

Steve