Every hour the server creates a new log file in the format of syslog_all.yyyy-mm-dd-hh and archives the file from the previous hour.

What I need is a way to grep through the current and yet-to-be-created log files for a certain string without having to re-start the command every hour just because the filename has changed.

Currently I do:

tail -f syslog_all.2017-04-25-09 | egrep -i --line-buffered "string1" | egrep -i "(.*first.*|.*second.*|.*third.*)"


Here's a high level recipe.

  1. Configure syslogd or rsyslogd (whichever your system uses) to output the required facility/priority messages to a named pipe in addition to where it goes now. Extract from man rsyslog.conf
Named pipes

   This  version  of  rsyslogd(8) has support for logging output to
   named pipes (fifos). A fifo or named pipe can be used as a  des‐
   tination  for  log messages by prepending a pipe symbol ('|') to
   the name of the file. This is handy for debugging. Note that the
   fifo  must  be  created  with the mkfifo(1) command before rsys‐
   logd(8) is started.

There is an example in my /etc/rsyslog.d/50-default.conf

    *.=notice;*.=warn       |/tmp/rt_monitor
  1. Create a named pipe and use tail and grep to read and search from the pipe.

    mkfifo /tmp/rt_monitor; tail -f /tmp/rt_monitor | grep "alert string"

You should check that system continues if named pipe becomes full if you do not have your consumer running and prevent this from occuring, I've given you a very crued recipe.

  • I cannot change how the syslog works. I can only access the log files :(
    – Unit0
    Apr 25 '17 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.