I have a transient prelink process populating our audit log, but we're not sure what the process is. The error log gives us the PID, but it disappears pretty much instantly, as the process finishes when it errors, I guess.
What I want to do is tail the log, grep out the PID, and pump that into a 'ps -p', or a 'ps -ef | grep PID'.
What I've got so far is:
ps -p $(tail -f /var/log/audit/audit.log | grep 'comm="prelink"' | grep -o 'pid=[0-9]* ' | grep -o [0-9]*)
But I think the shell expansion isn't updating, i.e. I run the command and the PID it finds from the last entry of the log is, say 1234, then ps is only ever searching for that, and it doesn't update.
I've tried variations around infinitely looping the output of the tail into PS, or into a grep of PS, but I'm not getting anywhere. I'm running tail -f of the log on its own in another window to see when it updates, and it definitely is, but the command to scrape PS for that PID isn't reacting.
Can anyone suggest a way to achieve what I'm trying to do?
Also, is there a really simple and better and obvious way to do this? I'm not super experienced and I have a habit of massively over-complicating things, so if you've got a "Why don't you just X", feel free to throw it in!
Thanks heaps! B.