script to grep specifics out of sulog

[KPS]

Hi,

Looking to make a very simple script that simply will be called by cron to cat the sulog to grep for a certain user. Could someone help as I'm quite "green" to scripting?


Thanks,

KPS

[Rick Garland · Accepted solution]

cat /var/adm/sulog | grep

Can use 'grep -i' to be case insensitive

This can be a 1-liner from command line or you can out into a script

[Patrick Wallek]

grep user /var/adm/sulog

That's really it. Nothing facy needed. That will return the entire line with "user" on it. Just put the appropriate user name in place of "user".

If you want this in a script:

# cat grep_su

#!/usr/bin/sh
grep user /var/adm/sulog

[Tom Schroll]

If you want it to be called from cron, you probably want to email the results to yourself. Here is a one line command that you can place in cron. Or if you want a script, you can place this in a script file as per the examples above.

grep user /var/adm/sulog | mailx -s "sulog user report" _admin_

Otherwise, cron will email an "error" that the job produced output.

NOTE: substitute _admin_ with whatever email address you need.

-- Tom

[Alan Meyer_4]

here's a script to monitor it simply.

Be sure to create a file called lastline with 0 in the first line to start. This way you'll only be given new lines each time it is run. Also to be sure to modify the grep part to contain the strings that you want to see.

#!/bin/ksh

# Get the last line read to only print out new lines
LASTLINE=`cat lastline`

CURLINE=0

# Read in all the syslog and only grep for desired strings past last line
cat /var/adm/syslog/syslog.log |while read LINE ;do
((CURLINE=CURLINE+1))
[[ $CURLINE -gt $LASTLINE ]] && echo "$LINE" |grep -E 'ftp|syslogd|inetd'
done

# Save out the last line read
echo $CURLINE > lastline