警报如果文件在5分钟内生长超过一定尺寸

Question

我正在尝试编写一个脚本来检查最近5分钟文件的数量，如果该时间在那段时间增长了20MB，则将其写入日志。<<<<<<<<<<

到目前为止，我已经设法写了;

output="$HOME/log/logsize.output"                       # This file is where the values are written to before being compared
currentsize=$(stat '-c%s' "$HOME/log/input.log")        # This is the current size of the log file
    echo $currentsize >> $output
oldsize=$(sed 'x;$!d' < "$output")                      # Sets the previous reading as "oldsize" by pulling the second to last line of $output
difference=$(("$currentsize" - "$oldsize"))             # This is the difference in size between the current and previous readings

if $difference > "1999999"                              # Checks the difference, if greater than 1999999 write an error.
    then
    echo "Warning! Log File has exceeded the expected rate of growth. Please investigate." > "$HOME/log/logalert.log"
else
    echo "Log File is within expected parameters" > "$HOME/log/logalert.log"
fi

运行此脚本时，这是我收到的输出;

line 23: "2910" - "2910": syntax error: operand expected (error token is ""2910" - "2910"")

解决！

这是我最终所做的工作

#!/bin/bash
#########################################################################
# Author - Jack Arnold
#
# Last Updated: 20.02.18
#########################################################################
#
# This script exists to periodically check the file size of a log file.
# If this file has grown 20MB or more since the last loop of this script
# it will write out an alert to ~/logs/logsize.log
#
#########################################################################

# Variables for the script.
output="$HOME/log/logsize.output"                       # This file is where the values are written to before being compared
currentsize=$(stat '-c%s' "$HOME/log/input.log")        # This is the current size of the log file
    echo "$currentsize" >> "$output"
oldsize=$(sed 'x;$!d' < "$output")                      # Sets the previous reading as "oldsize" by pulling the second to last line of $output
difference=$((currentsize - oldsize))                   # This is the difference in size between the current and previous readings

if [[ $difference > "1999999" ]]                        # Checks the difference, if greater than 1999999 write an error.
    then
    echo "Warning! Log File has exceeded the expected rate of growth. Please investigate." > "$HOME/log/logalert.log"
else
    echo "Log File is within expected parameters" > "$HOME/log/logalert.log"
fi

Answer 1

我注意到的第一件事是，在第一行中，变量分配(output="~/log/logsize.output"(会引起问题，因为~未用引号扩展。但是，此脚本中有更多的错误，我建议花更多的时间学习壳牌脚本的基础知识。我建议格雷格的Wiki是一个很棒的起点。

不久前，我更新了bash标签的用法指南，以便在https://www.shellcheck.net/中包含查看Shell脚本的建议，这是一个很棒的资源。确实，ShellCheck警告说Tilde问题，并包括使用$HOME代替~的有用建议。与其重新征用所有 ShellCheck会警告您的问题，我只会提及它没有解决的一些问题：

命令替代

currentsize=(stat '-c%s' "~/log/input.log")

我想您打算使用命令替换，以便currentsize变量包含stat命令的输出。这应该写为：

currentsize=$(stat '-c%s' "$HOME/log/input.log")

算术比较

ShellCheck在到达此行之前停止处理，但我注意到您将>用作算术比较操作员：

if (${difference} > 1999999) ;

在POSIX(类似于Unix的操作系统(外壳中，这些操作员用于输入和输出重定向 - 就像您在

中所做的那样

echo "Log File is within expected parameters" > "~/log/logalert.log"

Posix Shell中算术比较的正确操作员是-gt，而 Portable 测试的方法是：

if [ "$difference" -gt 1999999 ]

注意：诸如bash和ksh之类的外壳通过使用<和>进行算术比较扩展了POSIX，但这仅适用于 double> Double 括号内。请参阅比较整数：算术表达或条件表达。在BASH中，与[[构造一起使用时，>也可以用于字符串比较。请参阅bash条件表达式。

另外：如果字符串包含由外壳专门解释的不寻常字符(例如，空格会导致单词分开(，您才真正需要引用字符串。但是，如果您已经习惯了使用其他编程语言，并且发现它更可读。

一般提示

• 总是引用变量扩展(除非您明确要求单词分解(
• 调试时使用set -x。
• set -e也有助于通知错误，例如尝试访问不存在变量的内容。

Answer 2

我只是想提供我的解决方案：

#!/bin/bash
output="$HOME/log/logsize.output"
if [ ! -f $HOME/log/logsize.output ]
then
    touch $HOME/log/logsize.output
fi
while [ 1 ]
do
    stat '-c%s' $HOME/log/input.log >> "${output}"
    math=$(tail -n2 "${output}" | tr 'n' '-' | sed 's/.$//g')
# 20971520 bytes is 20 Mbytes. Uncomment this string, and comment mine with -100 argument. Mine string is only for the example.
#   if [ $(($math)) -lt -20971520 ]
    if [ $(($math)) -lt -100 ]
    then
        echo "Attemption! The file have has grown by more then 20Mbytes!"
    fi
# Replace sleep 5 by sleep 600 for 1 per 5 minute check.
sleep 5
done

您可以按照自己的意愿运行它：./filechange.sh &或在Cron中(如果您希望CRON，请删除while循环和sleep(它如何工作：

$ ls -l
total 4
-rwxr-xr-x 1 sahaquiel sahaquiel 400 Feb 20 15:00 filechange.sh
-rw-r--r-- 1 sahaquiel sahaquiel   0 Feb 20 14:58 input.log
-rw-r--r-- 1 sahaquiel sahaquiel   0 Feb 20 14:59 logsize.output
$ ./filechange.sh & 
[1] 29829
# Adding 150 random numbers in input.log file
[sahaquiel@sahaquiel-PC log]$ i=0; while [ $i -lt 150 ]; do echo $RANDOM >> input.log; i=$(($i + 1)); done
# filechange.sh echo in my shell:
[sahaquiel@sahaquiel-PC log]$ Attemption! The file have has grown by more then 20Mbytes!
$ ls -l
total 12
-rwxr-xr-x 1 sahaquiel sahaquiel 400 Feb 20 15:00 filechange.sh
-rw-r--r-- 1 sahaquiel sahaquiel 849 Feb 20 15:00 input.log
-rw-r--r-- 1 sahaquiel sahaquiel  14 Feb 20 15:00 logsize.output