Hello simple monitoring script need help

It looks as though you are looking for "GET" lines in your log file with the .wysiwygPro_edit_XXXX.php name in the same line, and you want to remove that particular .wysiwygPro_edit_XXXX.php file (and not any others), so you can't hard-code the filename in an environment variable.

My pattern assumes that the GET, HTTP and 200 appear in all lines you want to delete - if not, we can remove those from the sed command.

I do repeat a few lines of code in the script below - you*could* write the checking and deleting bit as a function and just call the function twice, but let's get the code working first!

As you can see, the script does two passes through the file.  "tail -f" only prints out the last 10 lines (by default, can make it bigger) of the file, so first we have to go through the entire file to delete any files mentioned before the last 10 lines.  We then do the tail -f to follow the end of the file.  This will also process out the last 10 lines of the exsiting file, but any .wysiwygPro_edit_XXX files mentioned in those 10 lines will have already been deleted in the "cat" section - those entries will be silently ignored.

#!/bin/sh 
# Look in the access.log for lines like this, and remove the particular wysiwyg file mentioned
# 99.99.99.99 - user [11/11/2009:21:40:30 -0000] "GET /3rdparty/wysiwyg/themes/blue/wysiwyg/buttons/bullets.gif HTTP/1.1" 200 0 "http://74.74.74.74:2082/cc/.wysiwygPro_edit_9dd4e461268c8034f5c8564e155c67a6.php?randomId=WkJjmE8Hqrxfi7EPw&realdir=%2fhome%2fuser%2fpublic_html%2fcc" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3" 
InputLogFile=/usr/local/cpanel/logs/access_log 
# First look at the entire access.log file to get any existing entries
cat $InputLogFile | while read line
do
  if echo $line | grep -q /cc/.wysiwygPro_edit_
  then
    # We have found a matching line - remove the file if it exists
    nams=$(echo $line | sed 's/^[^ ]* - \([^ ]*\).*GET .* HTTP.1.1. 200.*\(\.wysiwygPro_edit_[^?]*\).*/\1 \2/')
    # "nams" contains the userid and the .wysiwygPro_edit_XXX filename
    set $nams
    if [ -f /home/$1/public_html/cc/$2 ]
    then
      # The file exists - delete it
      rm /home/$1/public_html/cc/$2
    fi
  fi 
# Now "tail -f" the log file to catch new entries
tail -f $InputLogFile | while read line
do
  if echo $line | grep -q /cc/.wysiwygPro_edit_
  then
    # We have found a matching line - remove the file if it exists
    nams=$(echo $line | sed 's/^[^ ]* - \([^ ]*\).*GET .* HTTP.1.1. 200.*\(\.wysiwygPro_edit_[^?]*\).*/\1 \2/')
    # "nams" contains the userid and the .wysiwygPro_edit_XXX filename
    set $nams
    if [ -f /home/$1/public_html/cc/$2 ]
    then
      # The file exists - delete it
      rm /home/$1/public_html/cc/$2
    fi
  fi
done
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:

Why is it that you see erors just *after* you press submit, however often you check!

The middle of the script says:
        fi
      fi
    # Now "tail -f" the log file to catch new entries
    tail -f $InputLogFile | while read line

There should be a "done" after the second "fi", so it should be:

        fi
      fi
    done

    # Now "tail -f" the log file to catch new entries
    tail -f $InputLogFile | while read line

If you want it to run automatically, then the easiest way is probably to add it to your startup scripts for the machine.

For example, on my Ubuntu machine I have /etc/rc.local - put the above script into a file, e.g. /usr/local/bin/rem_swysiwyg_files.sh, make it executable, then add:

   /usr/local/bin/rem_wysiwyg_files.sh &

to /etc/rc.local (before the "exit 0" at the end of the file, and don't forget the "&" at the end of the line).  If you don't have /etc/rc.local, then there are other ways to do it.  One woudl be to add it to /etc/inittab:

   rw:345:respawn:/usr/local/bin/rem_wysiwyg_files.sh

If you are using a recent Linux, you might be using the "upstart" system to launch programs - I#ve not played with that much, so I hope on of the above methods works!

In all cases, these scritps run when the machine boots up.  They don't need anybody to be logged in.

All of the above methods run the script as root.