I have an application runnig on HP_UX which logs critical mesages to a log file.
What I would like to do is tail the log file and report on new messages. Easy....I here you say.
The log file is continuing to be written to and the check scritp will be executed from cron. I was thinking on having a file with the last wc -l stored in it and then having a variable that is the current wc -l of the log file.
How could I subtract the original wc from the stored wc to use in the tail -x? these would be only the new messages.
(orig wc) - (new wc) = tail -n lines
Do you know what I mean? From these new lines I will report and audit..
You may want to use sed instead of tail. You would have to keep the wc -l from the first run somewhere external to the script, probably in a small file. Then you could do something like this:
orig_wc=`cat file_with_line_count.txt`
new_wc=`wc -l log_file`
sed -n "$orig_wc,$new_wc p" |grep ERROR or whatever
You may have to play with the sed syntax but it should be close (doing it from memory).
How often do you want to run the script.
I've used a script that runs at 23:55 of every day and reports an email of the days errors to those onsite (24x7 operation).
If they need to action anything straight away they call, otherwise the Sys Admin's check it out when they come in (also included in the email distribution).
