script problem with monitoring log file

[Youlette Etienne_2]

I have the following script on our ftp server. It monitors the syslog file and greps for RETR. Once this occurs, it changes the permissions on the file to prevent the file from being ftp'd again by the same user. The file names are listed in another file, and another cron job removes these files from the ftp server at certain times.

The script works fine if I initiate an internal ftp login and transfer a file (or several files). However, it does not work with when the file is ftp'd via the external ftp session. The syslog shows the exact same information for the external ftp as the internal ftp:

Mar 6 21:05:23 e25 ftpd[20981]: RETR /ehdl20030306115127

This script is running continuously in the background.

LOGFILE=/var/adm/syslog/syslog.log

tail -1f $LOGFILE |while read line
do

echo $line |grep RETR
if [ "$?" = 0 ]
then
#get file name and place in file
echo $line | cut -f7 -d " ">/opt/maestro/scripts/file_name.log

#read each filename with path
file_name=`cat /opt/maestro/scripts/file_name.log`

find /ftpdata/ftpusers -name $file_name -exec chmod 400 {} \;
find /ftpdata/ftpusers -name $file_name -exec chown ftpadmin:ftpadmin {} \;
find /ftpdata/ftpusers -name $file_name -print >>/opt/maestro/scripts/file.log

fi
done

Your help is greatly appreciated.

thanks

[Robin Wakefield · Accepted solution]

Hi,

the log example shows the filename as:

/ehdl20030306115127

which indicates it is at the root of the file system. Yet your find is looking in another directory. Do you need to remove the leading "/" before saving the filename?

rgds, Robin

[Youlette Etienne_2]

Hi Robin,

Thanks for your quick response. The problem appears to be that it's looking for the name "/ehdl...", with "/" as part of the name. If you hadn't pointed that line out, I would have never seen it!
I checked the syslog file and the internal ftp sessions has only the file name, while the external sessions have the "/", as a result of the "cut" command.

Thanks