in reply to Re: Script Help
in thread Script Help

Thanks for the response, yes i can configure the mail-sending part of it. Here are my comments wrt your suggested script : - Although the log file is growing, but the alert would be based on snap shot of current content. - $uid , we cannot set this variable, and we're not sure of the user, that is the first thing we need to find. I mean logically, the script will scan through log file, pick every uid, then count number of occurrences, if the occurrence goes above the threshold, send an alert. Please help me in this regard. Regards, Pamela

Replies are listed 'Best First'.
Re^3: Script Help
by AnomalousMonk (Archbishop) on Jan 22, 2010 at 04:50 UTC

    Again assuming you are processing a static file, I would tend to attack the problem this way:

    • Define a regex to recognize and extract a unique UID. Something like
          my ($uid) = $line =~ m{ <uid= (\w+) }xms;
      seems like a good first guess.
    • Define a regex to recognize (and, if necessary, to extract) whatever an 'occurrence' may be.
    • If both a UID and an occurrence occur in a line, increment a UID count as appropriate to the occurence. This may be as simple as
          my %occurrences;
          # enter line processing loop
          # ..., recognize occurrence, extract UID from line, ...
          $occurrence{$uid}++;
          # process next line, etc.
      if all occurrences have equal weight.
    • When all lines in the file are processed, loop through the hash and send an appropriate message for each UID for which the count of occurrences exceeds the specified threshold.