script for searching

[Adam W.]

Guru's, I am VERY new to scripting (like I know nothing) and need some help. we have logging setup to where every day of the week a report is created from sshd.log and syslog.log, looking for failed authentications. The files are named sshd.log.Mon sshd.log.Tue etc... and syslog.log.Mon and syslog.log.Tue and so on for all 7 days of the week. I need to set something up that will automatically, every morning, search the specified file for that day of the week for a few select words like "failed" and "warning". I do not even know where to begin. Any help would be great.

[James R. Ferguson · Accepted solution]

Hi Adam:

This could be as simple as:

# cat ./searchlog
#!/usr/bin/sh
typeset FILE="sshd.log.$(date +%a)"
grep -Ei "failed|warning" ${FILE}
exit

...then, execute as needed or create a crontab to run every day as any convenient time.

Regards!

...JRF...

[Adam W.]

But will this portion:
typeset FILE="sshd.log.$(date +%a)"

difference between .Mon and .Tue and .Wed?

[James R. Ferguson]

Hi (again) Adam:

# echo "sshd.log.$(date +%a)"
sshd.log.Thu

...or the manpages for 'date(1)' will answer your question.

Regards!

...JRF...

[Patrick Wallek]

Why not try it out and see?

Or, have a look at the 'date' man page to see what 'date +%a' does.

[Adam W.]

I looked and pulled some good info from the man page. I had to make a slight adjustment, but nothing major. Thanks everyone.

[Adam W.]

Thanks.