Geek asks and answers

How to translate -f tail to awk

I am trying to configure a script where a warning appears when a specific line appears in the log file.

The solution that is already in use clears the entire log file daily and counts how often the line appears, using the timestamp of the log line to only count the occurrences in the previous minute.

I thought it would be much more efficient to do this with the tail, so as a test I tried the following:

FILENAME="/var/log/file.log"

tail -f $FILENAME | awk -F , -v var="$HOSTNAME" '
                BEGIN {
                        failed_count=0;
                }
                /account failure reason/ {
                        failed_count++;
                }
                END {
                        printf("%saccount failure reason (Errors per Interval)=%d\n", var, failed_count);
                }
'

but it just freezes and outputs nothing. Someone suggested this minor change:

FILENAME="/var/log/file.log"

awk -F , -v var="$HOSTNAME" '
                BEGIN {
                        failed_count=0;
                }
                /account failure reason/ {
                        failed_count++;
                }
                END {
                        printf("%saccount failure reason (Errors per Interval)=%d\n", var, failed_count);
                }
' <(tail -f $FILENAME)

but it does the same thing.

It uses awk, which I use (I am simplified in the code above), since it is used in an existing script, where grep "^ $ TIMESTAMP" results are passed to it.

: -f awk?

+5
1

, :

Jul 13 06:43:18 foo account failure reason: unknown
 │   │    
 │   └── $2 in awk
 └────── $1 in awk

- :

FILENAME="/var/log/file.log"

tail -F $FILENAME | awk -v hostname="$HOSTNAME" '
    NR == 1 {
        last=$1 " " $2;
    }
    $1 " " $2 != last {
        printf("%s account failure reason (Errors on %s)=%d\n", hostname, last, failed);
        last=$1 " " $2;
        failed=0;
    }
    /account failure reason/ {
        failed++;
    }
'

, tail -F ( F), . , BSD Linuces.

?

Awk test { commands; }, . ( : BEGIN END, awk awk . awk , END .)

script :

  • NR == 1 - , true . last, .
  • , "" . , , . () , reset .
  • , , , /account failure reason/, .

?: -)

+4

More articles:


All Articles