Tail??

Hello all,

I have search the forum and could not find an answer...Here is what I am trying to do. Every 15 minutes, a script send uptime output to a logfile (dailylog.log), that file contains lines like the one below:

11:21am  up 44 days, 19:15,  1 user,  load average: 0.00, 0.02, 0.03

Now, I am trying to extract only the before last line and send it to another file. The thing is that using tail -2 will show me the last 2 lines... I don't need that last line. The log is growing every 15 minutes so I don't know how many entries there are in the file.

echo $(tail -10 /dailyload.log)

Does anyone have a suggestion?

You want the next to the last line, right? And just the one line. And add the one line another file. Then wait 15 minutes and do it again?

while true
do
     tail -2 logfile | head -1 >>  anotherfile.log
     sleep 900
done

Tks Jim. Now what I do is putting the 13th argument of uptime command in a variable, the load, let's say 0.06 and now adding the last 24 hours load and doing an average of the total. Here is what I am trying to do:

#!/usr/bin/ksh
I_COUNT=96
C_CHAINE=0
until ((I_COUNT < 1))
do

tail -$I_COUNT /dailyload.log | head -1 | awk '{print $13}' > $C_CHAINE

#average
((C_CHAINE=C_CHAINE+$13))
((I_COUNT=I_COUNT-1))

done

((C_CHAINE=C_CHAINE/96))
echo $C_CHAINE

But can't make it work. Any idea?

It looks like you are taking the last 96 lines from the log and finding the mean of column 13.

tail -96 logfile | \
awk 'BEGIN { total=0 } { total+=$13 } END{ printf("Avg=%f\n", total/NR) }'

if I understood what you want.

That is exactlly what I am looking for. How could I get the highest load from the last 96 lines then?

tail -96 logfile | \
awk 'BEGIN { max=0 } { if($13>max){max=$13} } END{ printf("Max=%f\n", max) }'

It might however be better to count the colum from the right, rather then the left, because the time in uptime may not always contain the same numbert of fields.

Instead of $13 use $(NF-2)

Is this something sar/sadf could handle, rather than an unsightly script running $(uname -a) over and over?

What about a more unified package, like BigBrother or Nagios?