I am trying to create a script to monitor all logins using sudo, both success and failure.
Right now, I have:
set tdate = $(date "+%b %d") set attempted_su_log = /var/log/suattempts cat /var/log/secure | grep $tdate | grep 'servername su' >> $attempted_su_log
How can I grep the current date from /var/log/secure, so I only get entries from the day they occurred?
When I run
cat /var/log/secure | grep 'Mar 18' | grep 'servername su'
from the command line, I get the results I need, but I'm not sure how to write the script to grep with the current date, set as the $tdate variable.