0

I've got an IDS which creates log files inside a directory. These logs all start the same ie, IDS_log_XXXXX.

I have a perl script setup which would email me when these logs would contain certain flags.

However, I need a way to append the entire content of all the IDS_log_XXXXX logs as soon as they are created, to a specific file. Lets call that file ScriptScanning.txt.

Is there a way you guys can think of, which would do the following?

I might have to make it a script that would continuously run to do the above.

So to quickly recap:

IDS creates logs files inside a directory, I need the content of those log files to be appended to a specific file (ScriptScanning.txt), my script runs against that file, it sends me emails.

EDIT: I cant configure the IDS alerts to be registered in a single log file

  • 3
    cat IDS_log_* > ScriptScanning.txt will newly create an instance of the file containing the contents of all of the files. If, rather, you want to add to the combined file at the same time as the individual logs are written to, you could refactor whatever it is that is creating the files to use tee to write to both files at once, e. g. [...] | tee IDS_log_12345 >> ScriptScanning.txt. – DopeGhoti Jan 28 at 15:51
  • I don't understand the value of append the entire content of all the IDS_log_XXXXX logs as soon as they are created, -- aren't they empty as soon as they are created? At what later point would you want to copy them? – Jeff Schaller Jan 28 at 15:51
  • @JeffSchaller they're not empty they're like a report of flagged event, like a warning. I have a script that would go through a file and if content within the file matches XYZ conditions in the script, it would send me an email. I wouldn't want to copy or run that script at a later point. I would like to be notified right away. you know what im saying? – Boschko Jan 28 at 16:00
  • 1
    @Boschko if i understand it correctly, you would like to consolidate IDS log files to a single file. If this is correct, please check the first comment by DopeGhoti. If this is not helping, more details will be useful – Atul Jan 28 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.