Originally posted by: SystemAdmin

I am trying to get a data collection script working (for an audit). However, the command to find and tail the most recent syslog.ng files fails and I can't work out why. Below follow the key lines of the simple script...
________________________________________________
#!/bin/ksh
#Load all the commands I want executed into an "array" COMMAND_LIST - there are many, I have just listed two # working commands and the broken one below
set -A COMMAND_LIST 'no -a' \
'date' \
'nice -10 find / -type f ( -perm -004000 -o -perm -002000 ) -exec ls -ldb {} ;' \
#the above find works the below find doesn't!
*'nice -10 find /var/log/syslog-ng/ -name *.all -mtime -3 -exec ls -la {} \; -exec tail -n200 } ;'*

#Step through commands 1 by 1 labelling output.
i=0
while [ $i -lt ${#COMMAND_LIST*]}
do
echo "@@@@@_command ${COMMAND_LIST$i}"
${COMMAND_LIST$i}
(( i=i+1 ))
done
__________________________________________________

The syslog-ng files have names as below (one per day) and I want 200 lines from the 3 most recent....
syslog-ng.2009-09-08.all syslog-ng.2009-09-13.all syslog-ng.2009-09-18.all

Can anyone suggest what might be wrong?

Many thanks
Ross

Originally posted by: SystemAdmin

Try updating the command as shown below and let me know:

nice -10 find /var/log/syslog-ng/ -name "*.all" -mtime -3 -exec ls -la {} \; -exec tail -n200 {} \;

Changes: Put the wildcard (*.all) in quotes, opened the curly braces in tail, added backslash before the last semi-colon

Originally posted by: SystemAdmin

Thank you - I will try this evening and let you know how it goes

BR

Ross

Originally posted by: Casey_B

Hello Ross,

I think that you are fighting some globbing, or shell expansion problems.

Remember that you are trying to make sure that *.all is passed to the find command,
and not replaced by the shell with whatever is in the current directory that matches "*.all"

So for instance....
# cd /tmp/
# mkdir -p test/1
# touch ./test/base.all
# touch ./test/1/1.all
# find . -name *.all
./test/1/1.all
./test/base.all
# cd test
# This *.all will get expanded into "base.all" and passed to find.
# find . -name *.all
./base.all
# Backslash prevents *.all from being expanded in the current directory, and makes it pass to find.
# find . -name \*.all
./1/1.all
./base.all

If you run the find in a directory with "*.all" you will have different results.

Also in addition to that, you seem to have a typo as Rakesh noted in the second exec statement.
The shell expansion is made more difficult because you are trying to execute commands that are stored as
a list.

May I suggest that you instead look at set -x. You will get the logging of which command is being run, and
you will not need to try and store all of your commands in an array like that.

Hope this helps,
Casey
I think instead of trying to debug what is happening with the shell expansion, that you
should instead try to start from a little further back

Originally posted by: SystemAdmin

Hi RAR,

One learns something new each day. I have never seen a find with two exec's, so this is a first. Personally, I would have done an:
ls -lt /var/log/syslog-ng | tail -100
or
find ... | tail -100

I agree with the comment by others that you should quote the wildcard.

Regards,
George

Originally posted by: SystemAdmin

As George mentioned, even I had never used two execs with find. However when I tested, it did work and hence didnt mention it.

r/
R