Server log files analysis

[dimitar.dk]

Could anyone help me with shell script witch is analysing errors on server

[rch1231]

Well the first question is what errors are you trying to analyze (httpd, login, email, etc.)?
Then what do you want to look for and what do you want the script to do with errors it finds (email them to you, post to a file, etc.)?

[dimitar.dk]

Well the first question is what errors are you trying to analyze (httpd, login, email, etc.)?
Then what do you want to look for and what do you want the script to do with errors it finds (email them to you, post to a file, etc.)?

i want to analyse httpd and login errors on server and when error is found i want email to be sent or to be written in a file about it.

[rch1231]

There are already logs for httpd (Apache) for both successful access and errors. Normally they are kept in the /var/log/httpd directory but this can be changed in your httpd.conf file.

<VirtualHost 10.1.2.3>
ServerAdmin [e-mail]
DocumentRoot /www/docs/host.foo.com
ServerName host.foo.com
ErrorLog logs/host.foo.com-error_log
TransferLog logs/host.foo.com-access_log
</VirtualHost>

I use separate sets of log files for each domain on the server.

hat you are probably looking for is something like "logwatch". It monitors your logs and sends you a report daily for attempted hacks, login failures, web site failures etc. Google logwatch and you will see several links.

[dimitar.dk]

There are already logs for httpd (Apache) for both successful access and errors. Normally they are kept in the /var/log/httpd directory but this can be changed in your httpd.conf file.

<VirtualHost 10.1.2.3>
ServerAdmin [e-mail]
DocumentRoot /www/docs/host.foo.com
ServerName host.foo.com
ErrorLog logs/host.foo.com-error_log
TransferLog logs/host.foo.com-access_log
</VirtualHost>

I use separate sets of log files for each domain on the server.

hat you are probably looking for is something like "logwatch". It monitors your logs and sends you a report daily for attempted hacks, login failures, web site failures etc. Google logwatch and you will see several links.

thanks that worked really good. Bat i'm new in shell scripting and i want to write simple script that does a few things like logwatcher. open the logs filter then and send mail.

[ghostdog74]

it depends on what errors you are looking for. If there are 1000s of errors, are you going to send all 1000 ++ errors to your email?? you have to describe clearly your specs.

[dimitar.dk]

yes there are too many errors. for example errors in connection or something similar.

[JeoSaurus]

Here's an example of something I'm using to monitor an application log for a specific error. I'll put some generic variables in :)

#!/bin/bash

# Set some variables here
logfile="/path/to/logfile"
pattern="this.is.an.error"
email="[e-mail]"

# read each new line as it gets written
# to the log file
tail -fn0 $logfile | while read line ; do

  # check each line against our pattern
  echo "$line" | grep -i "$pattern"

  # if a line matches...
  if [ $? = 0 ]; then

    # send an email!
    echo "Found an error: $line" | mail $email -s ERROR

  fi
done

I hope this helps!

-G

[dimitar.dk]

Here's an example of something I'm using to monitor an application log for a specific error. I'll put some generic variables in :)

#!/bin/bash

# Set some variables here
logfile="/path/to/logfile"
pattern="this.is.an.error"
email="[e-mail]"

# read each new line as it gets written
# to the log file
tail -fn0 $logfile | while read line ; do

  # check each line against our pattern
  echo "$line" | grep -i "$pattern"

  # if a line matches...
  if [ $? = 0 ]; then

    # send an email!
    echo "Found an error: $line" | mail $email -s ERROR

  fi
done

I hope this helps!

-G

thanks this works and this is what i'm searching for

[JeoSaurus]

Excellent, glad I could help!