Automatically Email Select Syslog Messages

UNIX Solaris
1

Hi all,

I'm using Solaris 10 and would like to know how I can monitor the /var/adm/messages file for certain message types, and email them upon detection.
For example, I want to immediately email the IP-4-DUPADDR message as soon as it's generated so that people can respond to it ASAP.

Regards, Wynford

2

What process generates the IP-4-DUPADDR message on your system and what is the syslog logging level of that process?

3

To complete Neo's post, you should look at the /etc/syslog.conf file and doing a man of logger can be helpful.

4

Hi there,

I cannot find a IP-4-DUPADDR message right now, but another message that I would like to alert on is DUAL-5-NBRCHANGE. See below an example sent by a Cisco router with a logging level of "5" (Notice). The network syslog messages are constantly being written to the messages file, and I want to immediately alert on particular messages such as; DUAL-5-NBRCHANGE, IP-4-DUPADDR, etc.

hajwrs02.nls.jlrint.com %DUAL-5-NBRCHANGE: IP-EIGRP 521: Neighbor 10.224.32.45 (GigabitEthernet3/16) is up: new adjacency

Regards, Wynford

---------- Post updated at 10:44 AM ---------- Previous update was at 07:44 AM ----------

Hi all,

I suppose I can use an infinite While loop to do it.
I have a request to alert on the following message types:

DUAL-5-NBRCHANGE
IP-4-DUPADDR
STANDBY-3-DUPADDR

I just need an example script to use to search the messages file for the above message patterns and then email them to the users.

I have tried this script but it's not working:

while :
do
        tail -f /var/adm/messages | grep RTD-1-ADDR_FLAP | mailx -r Syslog -s "Syslog Address Flaps" <email_address>
done

Regards, Wynford

5

There are thousands of examples of code on this site that searches a file and performs some pattern matching. If you search the site, you will find plenty of examples.

6

Hi all,

I've searched the site for a suitable while loop command, but couldn't find one to suit that I can understand.
Please can someone help me out here, I'm sure it's simple for someone out there, I'm not familiar with the while loop and so cannot interpret what I'm reading in the many scripts I've come across.

This is what I've got so far, but do not want it to repeat if a new message is not detected or is the same, only unique one's needed:

while true
do
        cat /var/adm/messages | grep RTD-1-ADDR_FLAP | tail -1
sleep 10
done

Output at the moment, but need it to not repeat, but to be unique:

Nov 2 11:49:02 cbjsw205-1103.nls.jlrint.com 60577: Nov 2 11:49:01: %RTD-1-ADDR_FLAP: FastEthernet0/9 relearning 7 addrs per min
Nov 2 11:49:02 cbjsw205-1103.nls.jlrint.com 60577: Nov 2 11:49:01: %RTD-1-ADDR_FLAP: FastEthernet0/9 relearning 7 addrs per min
Nov 2 11:49:02 cbjsw205-1103.nls.jlrint.com 60577: Nov 2 11:49:01: %RTD-1-ADDR_FLAP: FastEthernet0/9 relearning 7 addrs per min
Nov 2 11:49:02 cbjsw205-1103.nls.jlrint.com 60577: Nov 2 11:49:01: %RTD-1-ADDR_FLAP: FastEthernet0/9 relearning 7 addrs per min
Nov 2 11:49:02 cbjsw205-1103.nls.jlrint.com 60577: Nov 2 11:49:01: %RTD-1-ADDR_FLAP: FastEthernet0/9 relearning 7 addrs per min

Regards, Wynford

7

I always write these types of scripts in PHP these days, so perhaps someone else can help who wants to write this in the shell script of your choice... which is?

8

Hi there,

The shell script of my choice is Bash.

Regards, Wynford

9

The problem with your script is you are reading messages file again from top without ignoring what has been read previously.

You can use the below solution.

 
while true
do
if [ ! -f /tmp/messages_checked ] ## Copy when executed for the 1st time
then
cp /var/adm/messages /tmp/messages_checked
fi
comm -13 /tmp/messages_checked /var/adm/messages > /tmp/messages_to_check ## Get the messages not checked
egrep 'DUAL-5-NBRCHANGE|IP-4-DUPADDR|STANDBY-3-DUPADDR' /tmp/messages_to_check > /tmp/messages_to_report ## check for needed message patterns
if [ `wc -l /tmp/messages_to_report | awk '{print $1}'` -gt 0 ] ## Will send mail if any pattern match found
then
mailx -s "URGENT : Messages there" <email address> < /tmp/messages_to_report
fi
cp /var/adm/messages /tmp/messages_checked ## Copy the checked messages
sleep 10
done

Cheers
Vishal

10

Thanks Vishal, this now works perfectly, thank you :slight_smile:

Regards, Wynford