Get lines out of /var/mail/root

[Coolmar]

Hi,

I have a whole bunch of emails come in each morning. I need to get the first and last line (date stamp and what cron job ran) out of each message. The problem is that /var/mail/root turns out to be one big file rather than all seperate messages, how you see them with "elm". Is there a way to do this?

Thanks

[Steven E. Protter]

Shalom Sally,

You merely type elm at the command prompt of an HP-9000 system. Assuming root mail is not diverted elsewhere by /etc/aliases this will let you view what you need.

You can also install qpopper from the Internet Express kit and read the mail into your outlook mail reader if you are unfortunate enough to use windows.

SEP

[Peter Godron]

Sally,
can't you use /var/adm/cron/log ?

[spex]

Sally,

See /var/adm/cron/log.

PCS

[Geoff Wild]

Why not have root mail forwarded to your email?

In /etc/mail/aliases

root: sdevine
sdevine: sdevine@yourdomain.com


Then run: newaliases

Rgds...Geoff

[Pete Randall]

You're going to need to use sed to print the line before and the line after the "From" line:

# print 1 line of context before and after regexp, with line number
# indicating where the regexp occurred (similar to "grep -A1 -B1")
sed -n -e '/regexp/{=;x;1!p;g;$!N;p;D;}' -e h

From "Handy One-Liners For Sed" (attached).


Pete

[Coolmar]

The cron log shows some of them but not all of them. There are many lines that show the date/time stamp but not the script that ran.

[Pete Randall]

Actually, as long as the last line is somewhat consistent, you could probably just use grep. For example, all our jobs run from the /apps directory, so the last line is going to contain "apps". In this case all you would need to do is run something like this:

grep -e From -e apps /var/mail/informix |grep -v "From:"


Pete

[Coolmar]

Plus the cron/log looks like the timestamp is when it starts...I need the finish time.

[Pete Randall]

By grepping from /var/mail file, you get the time when the email was sent which should be the finish time. The only trick is catching the last line of the email: easy if you run every thing from one directory and only slightly more complicated if there are multiple directories. Here's my sample output:

grep -e From -e apps /var/mail/informix |grep -v "From:"
From root Tue Sep 12 09:28:19 EDT 2006
/apps/hols/bin/hh/cleanUp.ksh

If there are multiple source directories, you can simply add them with multiple "-e" entries.


Pete

[spex]

Sally,

A single cron job is logged to /var/adm/cron/log in this format:

> CMD:
>
<

For example:

> CMD: /home/root/filecleanup.sh > /dev/null
> root 2328 c Sat Jul 29 19:10:00 EDT 2006
... Other entries ...
< root 2328 c Sat Jul 29 19:12:57 EDT 2006

To find the end time for any job, just match the pid to the start time.

PCS

[Doug O'Leary · Accepted solution]

Hey;

Interesting idea for a script - so I wrote it :)!

#!/usr/bin/perl

=cut
###############################################################
bad_crons: Attempts to ID cron jobs that are sending mail to root
Created based on an idea from itrc.
Author: Doug O'Leary
Created: 09/12/06
###############################################################
=cut

use strict;
my $last = '';
my $first = '';
my $subj = '';

my $mail_file = "/var/mail/root";
open (In, "< $mail_file") || die "Can't read $mail_file - ($!)";
while ()
{ next if (/^\s*$/);
chomp;
switch:
{ if (/^From root/)
{ printf("%-30s %s\n", $first, $last)
if (length($first) > 0 && length($subj) > 0);
($first) = $_ =~ m{from root[^\s]* (.*)}i;
$subj = '';
last switch;
}
if (/^Subject:\s+cron$/)
{ $subj = 'cron'; last switch; }
$last = $_;
}
}
close In;

sample output using one of my problem systems:
Mon Sep 11 08:02:01 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 09:02:01 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 10:02:00 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 11:02:00 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 12:02:00 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 13:02:00 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 14:02:01 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 14:02:01 EDT 2006 /usr/contrib/bin/secfile.sh
Mon Sep 11 14:02:01 EDT 2006 /usr/contrib/bin/secfile.sh
Mon Sep 11 16:02:00 EDT 2006 /usr/contrib/bin/check_root
Mon Sep 11 18:02:01 EDT 2006 /usr/contrib/bin/check_root
Tue Sep 12 01:02:00 EDT 2006 /usr/contrib/bin/check_root
Tue Sep 12 02:20:10 EDT 2006 /usr/local/bin/scanlog
Tue Sep 12 03:35:02 EDT 2006 /usr/local/bin/cleanall -r
Tue Sep 12 04:02:01 EDT 2006 /usr/contrib/bin/check_root
Tue Sep 12 05:02:01 EDT 2006 /usr/contrib/bin/check_root
Tue Sep 12 07:02:00 EDT 2006 /usr/contrib/bin/check_root

HTH;

Doug