[PLUG] Another grep question

[Felix Lee]

"Steven Raymond" <stever at woo-hoo.com>:
> DATESTR=`date -d "today" '+%b %e'`
> grep `echo "$DATESTR"` /var/log/maillog

There's no need to use echo here.  You can just say
    grep "$DATESTR" /var/log/maillog

Trying to quote that version with echo is tricky, because of the
way sh re-parses strings.  You have to say something like:
    grep "`echo \"$DATESTR\"`" ...

which defers interpretation of the nested quotes until
appropriate.  This is kind of awkward.  Another way of doing it
is to use a temp var to hold the result of the backquotes:
    result=`echo "$DATESTR"`
    grep "$result" ...

Another another way is to use $() instead of backquotes:
    grep "$(echo "$DATESTR")"

> Perhaps I should explain my end goal instead of bugging plug every 15
> minutes when I run into a new problem.  I simply want to make a daily (or
> perhaps every 4 hours) cron job that emails me the output of every line of
> my /var/log/maillog* which contains the word "reject" so I can keep track
> of spams (for alerting me to  false positives).

Something like this should work:
    touch old
    grep "reject" /var/log/maillog* > new
    diff old new | grep '^>'
    mv new old

That should be ok for running every 4 hours.  If you have a lot
of logs and don't want to keep rescanning them all, then
something like this should work:
    touch old oldlogs

    # find any logs that changed
    ls -l /var/log/maillog* > newlogs
    changedlogs=$(diff oldlogs newlogs | awk '/^>/ { print $10 }')
    mv newlogs oldlogs

    # find interesting lines in the changed logs
    grep "reject" $changedlogs > new
    diff old new | grep '^>'
    mv new old

Untested, there's probably a few bugs in it.
--