I want to grep this string 'FCE-Error' from a folder than contains loads of text based files

The folder looks like this

-rw-r--r-- 1 root root        0 May 22 10:30 T201805220930.CIR
-rw-r--r-- 1 root root 11298297 May 22 10:40 T201805220935.CDR
-rw-r--r-- 1 root root        0 May 22 10:35 T201805220935.CIR
-rw-r--r-- 1 root root 12230924 May 22 10:45 T201805220940.CDR
-rw-r--r-- 1 root root        0 May 22 10:40 T201805220940.CIR
-rw-r--r-- 1 root root 12707339 May 22 10:50 T201805220945.CDR
-rw-r--r-- 1 root root        0 May 22 10:45 T201805220945.CIR
-rw-r--r-- 1 root root 13080477 May 22 10:55 T201805220950.CDR
-rw-r--r-- 1 root root        0 May 22 10:50 T201805220950.CIR
-rw-r--r-- 1 root root 13762418 May 22 11:00 T201805220955.CDR
-rw-r--r-- 1 root root        0 May 22 10:55 T201805220955.CIR
-rw-r--r-- 1 root root 13582035 May 22 11:05 T201805221000.CDR
-rw-r--r-- 1 root root        0 May 22 11:00 T201805221000.CIR
-rw-r--r-- 1 root root 13910251 May 22 11:10 T201805221005.CDR
-rw-r--r-- 1 root root        0 May 22 11:05 T201805221005.CIR
-rw-r--r-- 1 root root  3360658 May 22 11:11 T201805221010.CDT
-rw-r--r-- 1 root root        0 May 22 11:10 T201805221010.CIT

It generates new files every 5 minutes CDT file = live running log file CDR file = is the previous CDT file before it generates a new one

I need a bash script which will either grep the .cdt or cdr file for this string FCE-Error

If it finds a positive value/entry then I need an alert on email


From the top of my head this should do:

[ $(find /path/to/dir -cmin -5 -type f -exec grep -F 'FCE-Error' {} \; | wc -l) -gt 0 ] && mail [...] # I let you complete mail command

This line search (find) for files (-type f) created in the last 5 minutes (-cmin -5) and for each execute grep, the output is then passed to wc to count lines, the overall result is compared to 0 (-gt) and if its true it trigger the mail command to send the mail.

You can set up this command to run every 5 minutes in cron and should avoid repeated alerts (out of a few edge cases when the alert just came and cron is not exactly on time)

  • I tried testing this with echo instead of mail but it fails $(find /var/cdrs/ -cmin -5min -type f -exec grep -F 'FCE-Error' {} \; | wc -l) -gt 0 ] && echo hello find: invalid argument -type' to -cmin' If '0' is not a typo you can use command-not-found to lookup the package that contains it, like this: cnf 0 – WMK83 May 22 '18 at 13:04
  • oops, remove min after 5, probably left between top of my head and small tests, editing to give proper command – Tensibai May 22 '18 at 13:16

Do you only want to grep the most recent .cdt/cdr file?

lastCIR="$(find ${dir} -type f -name '*.CIR' | tail -1)"
lastCDR="$(find ${dir} -type f -name '*.CDR' | tail -1)"

if grep FCE-Error "${lastCIR}" || grep FCE-Error "${lastCDR}";then
  echo 'alert' | mail -s subject mail@example.com
  • I assume there's a risk of looping the alert as there's multiple .CDT files on the same day – Tensibai May 22 '18 at 11:37
  • This will send an email if any of the files in /path/to/files contain the pattern FCE-Error. It would only send one email though. – rusty shackleford May 22 '18 at 11:41
  • I assume the script is to be run periodically to be alerted when the string appear... – Tensibai May 22 '18 at 11:42
  • It needs to look at the most recent files. The plan is to have it in Cron, then alert me when it sees this error. It may still be present in older files but we need to check for recent enteries – WMK83 May 22 '18 at 13:02

Assuming the files are in the current directory, ad that you're using bash:

files=( T*.CDT )
grep 'FCE-Error' "${files[-1]}"

This would grep the most recent .CDT file for the string. You could do the same for the other type of file.

The shell globbing pattern T*.CDT expands to all matching filenames sorted lexicographically, and since you are using sane filenames (with proper timestamps that sorts properly), the last of these will be the latest file.

To mail an alert if the string is found:

files=( T*.CDT )
if grep -q 'FCE-Error' "${files[-1]}"; then
    mail -s 'Alert' someperson@example.com <<END_MESSAGE
We've found "FCE-Error" in ${files[-1]}, do something!

Using some other POSIX shell:

set -- T*.CDT            # set positional parameter to all matching filenames
shift "$(( $# - 1 ))"    # shift off all but the last filename
if grep -q 'FCE-Error' "$@"; then
    mail -s 'Alert' someperson@example.com <<END_MESSAGE
We've found "FCE-Error" in ${files[-1]}, do something!
  • would i do this on a cron every minute? how would it know not to parse older files? – WMK83 Jun 2 '18 at 9:33
  • @WMK83 It looks like your log files are created every five minutes (if I'm interpreting the timestamps correctly). Using my code, you would always parse the last/latest file in the list (because your filenames sorts that way). If you do this every minute, you may ending up parsing the same file more than one time. – Kusalananda Jun 2 '18 at 9:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.