Log file new message monitoring

[Allanm]

I need to look into a log file for this messages "file system full" and it should alert me if this message is seen which can be achieved rather easily but the problem is if this message has been posted to the log for a long time and I want to be alerted for any new message and not old ones which are already residing in the log file.

How do I achieve this.

Thanks,
Allan.

[Court Campbell]

I think it would make more sense to either setup esm to send you alerts on file system usage, or to write a script that is run via cron to check the file system usage and send alerts.

[Tim Nelson · Accepted solution]

A simple log tracking script will work.
Here is the main idea of a simple script.

count lines in syslog.log
save this in a file for next time
check current line count with last line count
if different then use tail "-difference of above" syslog.log

If run through cron every 5,10 or 15 minutes it will give you all log entries since the last interval.

You can then be creative on what you want to alert for by using egrep with -vf and a exclude search file.

[Allanm]

Would this be a gud script for this or can u suggest improvements :

#!/usr/bin/ksh
. $HOME/.profile > /dev/null

grep "file system full" /var/adm/syslog/syslog.log > ~allanm/1
echo "Sleeping for 500 seconds"
sleep 500
grep "file system full" /var/adm/syslog/syslog.log > ~allanm/2

VAR1=`diff ~allanm/1 ~allanm/2|wc -l`

if [ ${VAR1} -gt 0 ]
then
mailx -s "check file system on b-box for space problems" allanm@tt.com < /dev/null
fi

[James R. Ferguson]

Hi Allan:

You script, as written, will run for one pass (of 500 seconds) only. Eliminate the 'echo' and you could create a cron job with something like:

#/usr/bin/sh
while true
do
...
if [ ${VAR1} -gt 0 ]; then
mailx -s "check file system on b-box for space problems" allanm@tt.com < /dev/null
sleep 500
done

Regards!

...JRF...

[Hein van den Heuvel]

Allan,

I appreciate your desire to tackle this yourself, and am pleased to see you post your own attempts vs asking 'the world' to solve your problem.

But as Court implies, this particular problem has been solved, and so much better so.

When the message 'File system full' appears, it is too late already!

There are several existing tools, freeware and formalware, which monitor disk space and a host of other conditions and will give early warning as well as alerts.

Unless your main goal is to learn scripting, be sure not to re-invent the wheel!

fwiw,
Hein.

[James R. Ferguson]

Hi (again) Allan:

Sorry, I meant to suggest a startup script, not a cron job, since the amended script runs "forever".

Regards!

...JRF...

[Allanm]

Yes Hein I am learning shell scripting so any help is welcome , I want to move to df -k solution where if the threshold is greater than 85% then I need to get notified ( but only ONCE as soon as any file system becomes more than 85% ) ... I want to achieve this through a shell script .

[Sandman!]

The bdf solution is better than scanning a logfile which is wrought w/ problems apart from being not proactive. With the script you can define warning, alert and critical stages when the email should be sent. See the script below if it'll do or change it.

bdf |
awk '{NF==1?getline n:n="";print $0n}' |
awk 'z[split($5,z,"%")-1] > 90' |
mailx -s "Filesystem > 90%" abc@xyz.com

Bill Hassell has a great script which might be exactly what you're looking for.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1124262&admit=-682735245+1189187355844+28353475