I am trying to create a script to monitor all logins using sudo, both success and failure.

Right now, I have:

set tdate = $(date "+%b %d")
set attempted_su_log = /var/log/suattempts

cat /var/log/secure | grep $tdate | grep 'servername su' >> $attempted_su_log

How can I grep the current date from /var/log/secure, so I only get entries from the day they occurred?

When I run

cat /var/log/secure | grep 'Mar 18' | grep 'servername su'

from the command line, I get the results I need, but I'm not sure how to write the script to grep with the current date, set as the $tdate variable.


You have to quote the argument to grep: grep "$tdate". This is because $tdate expands to two whitespace-separated words, which in turn get passed to grep as two arguments, unless the double quotes are added.

Your script could be improved to remove the useless use of cat, and to call grep only once:

</var/log/secure grep "$tdate.*servername su" >>"$attempted_su_log"
| improve this answer | |

tdate has a space in there. So, grep treats the second part of tdate as a filename. You will need to enclose $tdate in double quotes to prevent that. Your command should look like:

cat /var/log/secure | grep "$tdate" | grep 'servername su' >> $attempted_su_log
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.