监视关键字的日志文件，然后发送电子邮件通知

Question

I want to monitor a log that's continually generating, for a keyword to let me know if a component is down. Once the keyword is identified, I'd like to be notified via email to my personal gmail.

So far I've been able to accomplish the keyword monitoring and email notification separately but never together in a script. I've tried the following for monitoring:

tail -fn0 user | awk '/disconnect_tcp_conn/ { print | "echo server down" }'

And this to email:

mail -s "server down.... again" blahblah@gmail.com < /dev/null

I tried grep for monitoring but it seemed like awk worked best.. at least for how I used it. Just can't seem to get the syntax correct to make both work at the same time.

I've tried:

tail -fn0 user | awk '
                    /disconnect_tcp_conn/ { print | "echo server down") }
                    /disconnect_tcp_conn/ { system( "mail -s "server down.... again" blahblah@gmail.com < /dev/null ") }'

and also:

tail -fn0 user | awk '
                    /disconnect_tcp_conn/ { print | "echo server down") }
                    /disconnect_tcp_conn/ { cmd=mail -s "server down.... again3" blahblah@gmail.com < /dev/null ") }'

Any help would be great. Thanks!

Answer 1

You can have multiple lines in an {action} , and you can escape the double quotes \\" that you want to pass through system() :

tail -fn0 user | awk '/disconnect_tcp_conn/ { 
    system("mail -s \"server down... again\" blahblah@gmail.com </dev/null") 
    print "server down... again"
    exit
}'

Answer 2

It can simply also be done as below :

tail -f /path/to/file | while read line
do case "$line" in
        *"server down"*) echo "$line" | mutt -s "Server Down" an_email@mail.com;
        ;;
   esac
done