How to get the next x lines after a logfile message?

[Steven Damon]

I've had a request from a user that's got me a bit baffled. After a line occurs in a logfile that contains the word 'EXCEPTION' he would like the next 20 or so lines that occur afterward to be emailed to him. It's not a problem to create a tempalte to catch the word Exception and pass that single message on, but I've had little luck coming up with a script to pass on the next 20 messages that come afterwards. Has anyone else successfully come up with something that works for this? I am using OVO for UNIX on Solaris. Thanks.

[Steven Damon]

Nevermind... posted this in the wrong form. Sorry!

[Graham Cameron_1]

An awk script could do this if it will fit in with OVO.
This example allows you to pass in the no of lines you want...

awk -v lines=20 '
/EXCEPTION/ {
print
for (i=1;i<=lines;i++) {
getline
print
}
}
' logfile | mail youruser


-- Graham

[Steven Damon]

Thanks, Graham!

I'm having problems getting the script to run as is though... it's giving me the following:

awk: syntax error near line 1
awk: bailing out near line 1

I'm afraid I'm a bit too much of a scripting newbie to debug somethign like this... any ideas?

Thanks again!

Steve

[curt larson_1]

awk requires a ; at the end of statements.

for (i=1;i<=lines;i++) {
getline
print
}


should be

for (i=1;i<=lines;i++) {
getline;
print;
}

[Graham Cameron_1]

Should work ok if you cut and paste exactly.
Please check.
If still no joy please post your session output.
-- Graham

[Steven Damon]

I did copy and paste... making only the change to add logfile and email info. Still getting those syntax errors though. (Adding semicolons to the end of the getline and print as suggested didn't help, unfortunately.) Below is what I have entered and what I get after an attempted run. Thanks for continuing to look at this!

cpmgt2:/home/sdamon > more awk_exc
awk -v lines=20 '
/EXCEPTION/ {
print
for (i=1;i<=lines;i++) {
getline
print
}
}
' /home/sdamon/jaglogtmp | mail steve.damon@pacourts.us

cpmgt2:/home/sdamon > ./awk_exc
awk: syntax error near line 1
awk: bailing out near line 1

[curt larson_1]

you didn't add a ; after the first print.

awk -v lines=20 '
/EXCEPTION/ {
print

should be
awk -v lines=20 '
/EXCEPTION/ {
print;

[john korterman]

Hi Steven,
your cut and paste may have introduced an invisible garbage character; apparently in the first line. If everything fails, then try and type the code in a new file by hand.

regards,
John K.

[Steven Damon]

Typing it manually gave the same syntax errors. Adding semicolons to both print lines and the getline gave the same syntax errors. I do appreciate all the help, however. :-) Perhaps it's a difference between Solaris and HP-UX?

[Steven Damon]

Here's a look at the approach I've cooked up myself. As I said before, I'm a scripting newbie, but this seems to work, even if it's a bit ugly:

#!/bin/ksh
TIME=$1
NODE=$2
#echo $TIME $NODE >> /tmp/debug

#place each line with the time and the word EXCEPTION in /tmp/grepfile - precede each line with the line number
grep -n ${TIME}.*EXCEPTION mylogfile >> /tmp/grepfile

#place the first line of grepfile in the variable JUNKFILE
read JUNKLINE < /tmp/grepfile

rm /tmp/grepfile

#get just the line number and place it into /tmp/linenum
echo ${JUNKLINE} | cut -d: -f1 >> /tmp/linenum

#place the line number into the variable LINE
read LINE < /tmp/linenum

#if line number is the same as the last time the script ran, then don't send email

mv /tmp/linenum /tmp/lastline

#Place the twenty lines into a mailfile
let LINE=${LINE}+19
head -${LINE} mylogfile | tail -20 >> /tmp/mailfile

mailx -s "EXCEPTION on ${NODE}" steve.damon@pacourts.us < /tmp/mailfile
rm /tmp/mailfile

[john korterman]

Hi again,
nice to hear that people are able to solve the problems themselves!
I just looked into a solaris machine and read a bit from the awk man page. Apparently, the "normal" awk on Solaris does not like the variable assignment, the -v. For the fun of it, you could try this instead:

/usr/xpg4/bin/awk -v lines=20 '
/EXCEPTION/ {
print
for (i=1;i<=lines;i++) {
getline
print
}
}
' /home/sdamon/jaglogtmp | mail steve.damon@pacourts.us

regards,
John K.

[Steven Damon]

That did the trick! Thanks!!! Very nice script... I'll have to take some time to delve into how it works!

[Graham Cameron_1]

Sorry, didn't make the Solaris connection, I was testing on HP.

Anyway, here's a slightly improved algorithm. The original would blindly print 20 lines after EXCEPTION. So if the 19th line also contained "EXCEPTION" you would get only the next (20th) line, not another 20.

This fixes that deficiency and uses other awk features for you to read up on.

And note that you do not need semicolons after commands within awk unless you are puting more that one command per line, when the semicolon is a required separator.

here you go:

/usr/xpg4/bin/awk -v lines=20 '
/EXCEPTION/ {toprint=lines+1}
(toprint-- > 0)
' /home/sdamon/jaglogtmp | mail steve.damon@pacourts.us

(And before someone points it out, this will fail if your log file has > 2147483647 lines between "EXCEPTIONS" !!)

-- Graham