Check Logfiles Only a Few Minutes Back
This is an update post. Previously I had a post here: http://blog.ls-al.com/check-logfiles-for-recent-entries-only/
The code has been problematic around when a new year starts because of the lack of a year in the log entries. I updated the code a little bit to account for the year ticking over. I may still need to come up with a better way but below seem to work ok.
#!/usr/bin/python # #: Script Name : checkLogs.py #: Version : 0.0.1.1 #: Description : Check messages for last x minutes. Used in conjunction with checkLogs.sh and a cron schedule from datetime import datetime, timedelta #suppressPhrases = ['ssd','offline'] suppressPhrases =  #now = datetime(2015,3,17,7,28,00) ## Get time right now. ie cron job execution now = datetime.now() day_of_year = datetime.now().timetuple().tm_yday ## Used for special case when year ticks over. Older log entries should be one year older. ## How long back to check. Making it 11 mins because cron runs every 10 mins checkBack = 11 lines =  #print "log entries newer than " + now.strftime('%b %d %H:%M:%S') + " minus " + str(checkBack) + " minutes" with open('/var/adm/messages', 'r') as f: for line in f: myDate = str(now.year) + " " + line[:15] ## Solaris syslog format like this: Mar 11 12:47:23 so need to add year if day_of_year >= 1 and day_of_year <= 31: ## Brain dead log has no year so special case during January if not "Jan" in myDate: #2015 Dec 30 myDate = str(now.year -1) + " " + line[:15] if myDate == " ": ## What about "Mar 1" having double space vs "Mar 15". That will break strptime %d. myDate = myDate.replace(myDate,"0") ## zero pad string position 4 to make %d work? #print "myDate: %s and now: %s" % (myDate,now) lt = datetime.strptime(myDate,'%Y %b %d %H:%M:%S') diff = now - lt if diff.days <= 0: if lt > now - timedelta(minutes=checkBack): #print myDate + " --- diff: " + str(diff) match = False for s in suppressPhrases: i = line.find(s) if i > -1: match = True if not match: lines.append(line) if lines: message = '\n'.join(lines) print message # do some grepping for my specific errors here.. send message per mail...