jcoffey-dev
5d417f3c4c
The scripts were attributed to LINUXexpert.org, which is being retired as a site and is no longer where this work lives. Coffey Labs is the organisation these projects belong to. One line per script, fifteen of them, and nothing else. LICENSE is deliberately untouched: its "Copyright (C) <year> <name of author>" lines are GPL boilerplate showing you how to write your own notice, and the Free Software Foundation's own copyright on the licence text is not ours to edit. Both git contributors are the same person, so there is no third-party copyright here that could not be restated.
74 lines
2.6 KiB
Bash
74 lines
2.6 KiB
Bash
#!/bin/bash
|
|
# log_inspect.sh - Search or tail system log files
|
|
#
|
|
# Copyright (C) 2025 Coffey Labs
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by the
|
|
# Free Software Foundation, version 3 of the License.
|
|
#
|
|
# This program is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
# for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License along
|
|
# with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
#
|
|
# Usage: log_inspect.sh [search <pattern> | tail <logfile>]
|
|
# Description: Searches across /var/log for a pattern, or tails a specific log file.
|
|
#
|
|
# Most of /var/log is root-only. Run this with sudo, or results will be
|
|
# quietly partial -- see the note on the search branch.
|
|
|
|
set -euo pipefail
|
|
|
|
if [ "${1:-}" = "search" ]; then
|
|
pattern="${2:-}"
|
|
if [ -z "$pattern" ]; then
|
|
echo "Usage: $0 search <pattern>"; exit 1
|
|
fi
|
|
echo "Searching for '$pattern' in /var/log..."
|
|
# 2>/dev/null hid permission errors, so an unprivileged run looked like
|
|
# "no matches" rather than "could not read most of /var/log". Say so
|
|
# explicitly instead. grep exits 1 on no match, which is not an error.
|
|
# grep distinguishes three outcomes and they mean different things
|
|
# here: 0 matched, 1 matched nothing, 2 could not read everything. The
|
|
# original discarded stderr and ignored the status, so an unprivileged
|
|
# run over root-owned logs was indistinguishable from a clean search.
|
|
status=0
|
|
grep -R -i --color=auto -- "$pattern" /var/log 2>/dev/null || status=$?
|
|
case "$status" in
|
|
0) ;;
|
|
1) echo "No matches found." ;;
|
|
*)
|
|
echo "Search was incomplete -- some files under /var/log could not be read." >&2
|
|
[ "$EUID" -ne 0 ] && echo "Re-run with sudo for a complete search." >&2
|
|
exit "$status"
|
|
;;
|
|
esac
|
|
exit 0
|
|
elif [ "${1:-}" = "tail" ]; then
|
|
logfile="${2:-}"
|
|
if [ -z "$logfile" ]; then
|
|
echo "Usage: $0 tail <log_file_path>"; exit 1
|
|
fi
|
|
if [ ! -f "$logfile" ]; then
|
|
echo "Log file '$logfile' not found."; exit 1
|
|
fi
|
|
echo "== Last 100 lines of $logfile =="
|
|
tail -n 100 "$logfile"
|
|
exit 0
|
|
else
|
|
# Default: tail the main system log (syslog or messages)
|
|
if [ -f /var/log/syslog ]; then
|
|
echo "== Last 50 lines of /var/log/syslog =="
|
|
tail -n 50 /var/log/syslog
|
|
elif [ -f /var/log/messages ]; then
|
|
echo "== Last 50 lines of /var/log/messages =="
|
|
tail -n 50 /var/log/messages
|
|
else
|
|
echo "No syslog or messages log found."
|
|
fi
|
|
fi
|