Question

我的要求是使用cron作业中的shell脚本读取正在不断更新的服务器日志（相对较大）文件。我将阅读直到找到可用的字符串的最后一行，如果找到了字符串，则会发送电子邮件。下次cron作业开始时，应从上次完成作业的行或位置读取该作业。任何建议如何在shell脚本中做到这一点。

Answer 1

以下内容可以帮助您入门：

tail -f your_file | while read line
do case "$line" in
        *"string_to_search"*) echo "" | mutt -s "Guilty string found" a_mail@mail.com       
;;
   esac
done

Answer 2

我使用timeout来使tail超时并使用一些保存文件来保存我们解析的行位置：

# statefile where we save the number of parsed already lines
statefile=/tmp/statefile.txt

# initialize count variable - to zero, or from statefile
if [ -e "$statefile" ]; then
    count=$(<"$statefile")
else
    count=0
fi

# we timeout for 1 seconds outputting the lines
# the better timeout would be like 10 seconds for big file
# the `tail` command needs to jump `$count` lines inside the input file
timeout 1 tail -n +$count input_log_file |
# tee is used to pass the input to the updating part
tee >(
     # read number of parsed lines with `wc -l`
     # increment the count of parsed lines and save to statefile
     echo $(( count + $(wc -l) )) >"$statefile"
) |
# grep for the searched string
grep --line-buffered string_to_search |
# do the action if string_to_search is found
do_some_action_example_send_mail

Shell脚本从最后读取的行读取日志文件

2 个答案: