Link to home
Start Free TrialLog in
Avatar of luser9999
luser9999

asked on

Linux shell script to monitor changed files

Hi,

I am trying to write a shell script to monitor file changes in Red hat linux but had some problems.

=============filemod.sh=========================

#!/bin/bash

dir=/
freq='-1'
email=me@domain.com
udate=`date +%y-%m-%d`
utime=`date +%H:%M`
check=`find $dir -mtime $freq -type f -exec ls -lh {} \;`
count=`cat $check | wc -l`

if [ $count -gt 0 ]
then
               sub="Attention! $count File Modified on $udate at $utime"
              echo `cat $check` | mail -s "$sub" $email
        else
               echo "no files were modified on $udate at $utime
       fi

fi

I have problems to execute the script. Can someone please optimize it or correct it. I need this report should email on dialy basis for every day (so may be -1 should ok?) and also use cron for this

thanks
Avatar of woolmilkporc
woolmilkporc
Flag of Germany image

You have one extra "fi" which is wrong.

What other errors do you get?

Avatar of luser9999
luser9999

ASKER

find: /proc/5412/task/5412/fd/4: No such file or directory
find: /proc/5412/fd/4: No such file or directory
./file-mod.sh: line 9: /bin/cat: Argument list too long
./file-mod.sh: line 16: unexpected EOF while looking for matching `"'
./file-mod.sh: line 19: syntax error: unexpected end of file
The first 2 errors are from transitory files that only exist for milliseconds, so have disappered, you can ignore these.

Cat error on line 9 - obviously you are generating an enormous list of file where modified in the last day (probably every log file, database file etc).  Cat just cannot handle this huge volume of text.

line 16
 echo "no files were modified on $udate at $utime
should be
 echo "no files were modified on $udate at $utime"
ASKER CERTIFIED SOLUTION
Avatar of woolmilkporc
woolmilkporc
Flag of Germany image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thanks. It looks to be working. But the Email I got with weird text init. Here is the example

1 root root 0 May 16 06:39 /proc/kallsyms -r--r--r-- 1 root r!
oot 0 Ma
y 16 06:39 /proc/dma -r--r--r-- 1 root root 0 May 16 06:39 /proc/iomem -r--r--r-- 1 root root 0 May 16 06:39 /proc/ioports -r--r--r-- 1 root root 0 May 16 06:39 /proc/misc -r--r--r-- 1 root root 0 May 16 06:39 /proc/acpi/button/power/PWRF/info -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/wakeup -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/alarm -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/thermal_zone/THM0/polling_frequency -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/thermal_zone/THM0/cooling_mode -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/thermal_zone/THM0/trip_points -r--r--r-- 1 root root 0 May 16 06:39 /proc/acpi/thermal_zone/THM0/temperature -r--r--r-- 1 root root 0 May 16 06:39 /proc/acpi/thermal_zone/THM0/state -r--r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU3/power -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU3/limit -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU3/throttling -r--r--r-- 1 root root !
0 May 16 06:39 /proc/acpi/processor/CPU3/info -r--r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU2/power -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU2/limit -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU2/throttling -r--r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU2/info -r--r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU1/power -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU1/limit -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU1/throttling -r--r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU1/info -r--r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU0/power -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU0/limit -rw-r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU0/throttling -r--r--r-- 1 root root 0 May 16 06:39 /proc/acpi/processor/CPU0/info -r-------- 1 root root 0 May 16 06:39 /proc/acpi/fadt -r-------- 1 root root 0 May 16 06:3!
9 /proc/acpi/dsdt -r--r--r-- 1 root root 0 May 16 06:39 /proc/!
acpi/inf
o -r--r--r-- 1 root root 0 May 16 06:39 /proc/fb -rw------- 1 root root 0 May 16 06:39 /proc/irq/98/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/90/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/82/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/74/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/15/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/14/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/13/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/12/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/11/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/10/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/9/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/8/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/7/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/6/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/!
5/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/4/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/3/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/2/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/1/smp_affinity -rw------- 1 root root 0 May 16 06:39 /proc/irq/0/smp_affinity -rw-r--r-- 1 root root 256 May 16 06:39 /proc/bus/pci/01/04.6 -rw-r--r-- 1 root root 256 May 16 06:39 /proc/bus/pci/01/04.4 -rw-r--r-- 1 root root 256 May 16 06:39 /proc/bus/pci/01/04.2 -rw-r--r-- 1 root root 256 May 16 06:39 /proc/bus/pci/01/04.0 -rw-r--r-- 1 root root 256 May 16 06:39 /proc/bus/pci/03/04.1 -rw-r--r-- 1 root root 256 May 16 06:39 /proc/bus/pci/03/04.0 -rw-r--r-- 1 root root 256 May 16 06:39 /proc/bus/pci/02/00.0 -rw-r--r-- 1 root root 256 May 16 06:39 /proc/bus/pci/00/1f.5 -rw-r--r-- 1 root root 256 May 16 06:39 /proc/bus/pci/00/1f.2 -rw-r--r-- 1 root root 256 May 16 06:39 /proc/bus/pci/00/1f.0 -rw-r--r-- 1 root root 256 May 16 06:3!
9 /proc/bus/pci/00/1e.0 -rw-r--r-- 1 root root 256 May 16 06:3!
9 /proc/

How can we make this to a proper alignment? like copying the whole data to a text file and then read from it??

thanks
Sorry, I overlooked these:

...
count=`echo "$check" | wc -l`
...
echo "$check" | mail -s "$sub" $email


It's a matter of the quotation marks around "$check". They're needed to preserve the linefeeds!

awesome, its looks great now. Last question, the above output gives me around 37858 files were modified for a day. Is there anyway to look only certain specified folders or file systems like

dir=/etc
dir=/opt
dir=/var

can we search for files only in above directories with the above script?

woolmilkporc, thanks for helping

thanks



Yes, of course.

Change

dir=/

to

dir="/etc /opt /var"

to search all three dirs. "find" can work on more than one path in one run.

wmp
I will try this later today or tomorrow and let you know.

thanks wmp. you are a great help. You got ur points
WMP ROCK