How to Monitor Log Files and Detect Specific Text on Linux Using a Bash Script

Monitoring log files and detecting specific text patterns is a crucial task for IT professionals, particularly in the context of system administration and cybersecurity. Automated scripts that can alert on specific text strings within files are invaluable tools in an IT professional’s toolkit.

The script provided accomplishes this task effectively, offering a robust solution for monitoring log files and alerting on the occurrence of specific text strings. This blog post will delve into the script’s functionality, explore its real-world applications, and discuss best practices for its use.

Understanding the Script and Its Significance

In IT environments, log files are continuously generated by various systems, applications, and processes. These logs contain vital information about the system’s operations, errors, security events, and user activities. However, manually monitoring these files for critical events or text strings is impractical and prone to human error. This is where automation through scripting becomes essential.

The script provided is designed to search for specific text within a log file and generate an alert when that text is found. This script is particularly useful for Managed Service Providers (MSPs) and IT administrators who need to monitor logs for security incidents, application errors, or any other significant events that might require immediate attention.

The Script:

#!/usr/bin/env bash

# Description: Alert when the specified Text is found in a text file.
#
# Release Notes: Initial Release
#   By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https://ninjastage2.wpengine.com/terms-of-use.
#   Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. 
#   Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. 
#   Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. 
#   Warranty Disclaimer: The script is provided “as is” and “as available”, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. 
#   Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. 
#   Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. 
#   EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).
#
# Text to trigger on: [Alert]
#
# Below are all the valid parameters for this script.
# Preset Parameter: --file "/opt/MyLogFile.log" --text batman
#   Alerts when the text "batman" is found in the file /opt/MyLogFile.log
#    This is Case Sensitive
#     Example where it will alert: "I am batman!"
#     Example where it will alert: "Iambatman!"
#     Example where it will not alert: "IamBatman!"
#     Example where it will not alert: "I am Batman!"
#
# Preset Parameter: --file "/opt/MyLogFile.log" --text Batman --caseInsensitive true
#   Alerts when the text "Batman" is found in the file /opt/MyLogFile.log, but is case insensitive
#    This is Case Insensitive
#     Example where it will alert: "I am batman!"
#     Example where it will alert: "Iambatman!"
#
# Preset Parameter: --file "/opt/MyLogFile.log" --text Batman --wholeWord true
#   Alerts when the text "Batman" is found in the file /opt/MyLogFile.log, but only if it is a word in a sentence.
#    This is Case Sensitive
#     Example where it will alert: "I am Batman!"
#     Example where it will not alert: "IamBatman!"
#

# Determines whether or not help text is necessary and routes the output to stderr
die() {
    local _ret="${2:-1}"
    test "${_PRINT_HELP:-no}" = yes && print_help >&2
    echo "$1" >&2
    exit "${_ret}"
}

# Function that evaluates whether a value passed to it begins by a character
# that is a short option of an argument the script knows about.
# This is required in order to support getopts-like short options grouping.
begins_with_short_option() {
    local first_option all_short_options='ftiwh'
    first_option="${1:0:1}"
    test "$all_short_options" = "${all_short_options/$first_option/}" && return 1 || return 0
}

# THE DEFAULTS INITIALIZATION - OPTIONALS
_arg_file=
_arg_text=
_arg_caseInsensitive="false"
_arg_wholeWord="false"

# Help text function for when invalid input is encountered
print_help() {
    printf '%s\n' "Alert when the specified Text is found in a text file."
    printf 'Usage: %s [-f|--file [path to file]] [-t|--text [text to search]] [-i|--caseInsensitive <true|false>] [-w|--wholeWord <true|false>] [-h|--help]\n' "$0"
    printf '\t%s\n' "-f, --file: path to a log file"
    printf '\t%s\n' "-t, --text: text to alert when found"
    printf '\t%s\n' "-i, --caseInsensitive: search text with case insensitivity (default: false)"
    printf '\t%s\n' "-w, --wholeWord: search for text as a whole word (default: false)"
    printf '\t%s\n' "-h, --help: Prints help"
}

# Grabbing the parameters and parsing through them.
parse_commandLine() {
    while test $# -gt 0; do
        _key="$1"
        case "$_key" in
        -f | --file)
            test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
            _arg_file="$2"
            shift
            ;;
        --file=*)
            _arg_file="${_key##--file=}"
            ;;
        -f*)
            _arg_file="${_key##-f}"
            ;;
        -t | --text)
            test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
            _arg_text="$2"
            shift
            ;;
        --text=*)
            _arg_text="${_key##--text=}"
            ;;
        -t*)
            _arg_text="${_key##-t}"
            ;;
        -i | --caseInsensitive)
            test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
            _arg_caseInsensitive="$2"
            shift
            ;;
        --caseInsensitive=*)
            _arg_caseInsensitive="${_key##--caseInsensitive=}"
            ;;
        -i*)
            _arg_caseInsensitive="${_key##-i}"
            ;;
        -w | --wholeWord)
            test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
            _arg_wholeWord="$2"
            shift
            ;;
        --wholeWord=*)
            _arg_wholeWord="${_key##--wholeWord=}"
            ;;
        -w*)
            _arg_wholeWord="${_key##-w}"
            ;;
        -h | --help)
            print_help
            exit 0
            ;;
        -h*)
            print_help
            exit 0
            ;;
        *)
            _PRINT_HELP=yes die "FATAL ERROR: Got an unexpected argument '$1'" 1
            ;;
        esac
        shift
    done
}

parse_commandLine "$@"

text=$_arg_text
file=$_arg_file
caseInsensitive=$_arg_caseInsensitive
wholeWord=$_arg_wholeWord

# Check if Script Variables where used and overwrite command line parameters
if [[ -n "${textToMatch}" ]]; then
    text=$textToMatch
fi
if [[ -n "${textFile}" ]]; then
    file=$textFile
fi
if [[ -n "${matchWholeWord}" ]]; then
    wholeWord=$matchWholeWord
fi
if [[ -n "${insensitiveToCase}" ]]; then
    caseInsensitive=$insensitiveToCase
fi

# Check if text is not an empty string
if [[ -z "${text}" ]]; then
    echo "[Error] Text not specified"
    exit 2
fi

# Check if text is not an empty string
if [[ -z "${file}" ]]; then
    echo "[Error] File not specified"
    exit 2
fi

# Does file exit and is readable
if [ -f "${file}" ]; then
    echo "[Info] File \"${file}\" exists"
    if [ -r "${file}" ]; then
        echo "[Info] File \"${file}\" is readable"
    else
        echo "[Error] File \"${file}\" is not readable"
        exit 2
    fi
else
    echo "[Error] File \"${file}\" does not exists"
    exit 2
fi

# Detect
count=0
if [[ "${wholeWord}" == "true" ]]; then
    if [[ "${caseInsensitive}" == "true" ]]; then
        count=$(grep -c -i -n -w "$text" "$file")
    else
        count=$(grep -c -n -w "$text" "$file")
    fi
else
    if [[ "${caseInsensitive}" == "true" ]]; then
        count=$(grep -c -i -n -e "$text" "$file")
    else
        count=$(grep -c -n -e "$text" "$file")
    fi
fi

# Alert
if ((count > 0)); then
    echo "[Alert] Found text in file"
    exit 1
else
    echo "[Info] Not found text in file"
    exit 0
fi

 

Detailed Breakdown of the Script

Let’s take a closer look at how this script operates:

1. Parameter Parsing: 

• The script begins by defining default parameters such as _arg_file, _arg_text, _arg_caseInsensitive, and _arg_wholeWord. These parameters are then parsed from the command line, allowing the user to specify the file to be monitored, the text to search for, and whether the search should be case-insensitive or limited to whole words.

2. Command-Line Arguments: 

• Users can pass various arguments like –file, –text, –caseInsensitive, and –wholeWord to customize the script’s behavior. For instance, –file specifies the path to the log file, while –text indicates the text to search for. The script also supports case-insensitive searches and searches restricted to whole words.

3. Validation:

• The script performs several validation checks, such as ensuring that both the text to search for and the file path are provided. It also checks whether the specified file exists and is readable. These validations prevent the script from running under improper conditions, thus avoiding potential errors.

4. Text Searching:

• The core functionality of the script revolves around the grep command, which searches for the specified text within the log file. Depending on the parameters provided, the script can perform case-insensitive searches or search only for whole words. The result of the grep command is stored in the count variable, which indicates how many times the specified text was found.

5. Alert Mechanism:

• If the text is found within the file, the script generates an alert by printing a message and exiting with a status code of 1. If the text is not found, it exits with a status code of 0, indicating no alert condition.

Real-World Use Cases

Consider an MSP tasked with monitoring a client’s server logs for specific security threats, such as failed login attempts. This script could be configured to search the log files for phrases like “Failed password” or “Authentication failure.” When the script detects these phrases, it would immediately alert the MSP, allowing them to take swift action to investigate and mitigate potential security breaches.

Another example could be a system administrator who needs to monitor application logs for critical errors. By configuring the script to search for keywords such as “ERROR” or “CRITICAL,” the administrator can ensure they are promptly alerted to any issues that may affect the application’s performance or availability.

Comparisons to Other Methods

While there are various tools and methods available for log file monitoring, such as using centralized log management solutions like ELK Stack (Elasticsearch, Logstash, Kibana) or cloud-based monitoring tools, this script offers a lightweight and straightforward solution that requires no additional infrastructure. It’s ideal for scenarios where simplicity and quick deployment are key, or where a full-fledged monitoring system might be overkill.

Frequently Asked Questions

• Q: Can this script be used on non-Linux systems?
• A: This script is designed for Unix-like systems, such as Linux. It relies on commands like grep, which are standard in these environments. While it could theoretically be adapted for other systems, it would require modifications.
• Q: How does the script handle large log files?
• A: The script utilizes grep, which is efficient even with large files. However, for extremely large files, performance could be impacted. In such cases, using a log rotation mechanism or more advanced log management tools might be advisable.
• Q: What happens if multiple instances of the text are found?
• A: The script counts all instances of the text in the file and triggers an alert if any matches are found, regardless of the number of occurrences.

Implications for IT Security

The ability to monitor log files for specific text strings is crucial in maintaining the security and stability of IT systems. This script can be a critical component of a broader security strategy, helping IT professionals detect and respond to potential threats quickly. By automating the monitoring process, the script reduces the risk of missed alerts and ensures that critical issues are brought to attention in real time.

Recommendations for Using the Script

• Regularly Update the Script: Ensure that the script is kept up to date with the latest features and improvements. Regular updates can also help address potential security vulnerabilities.
• Integrate with Other Tools: Consider integrating this script with notification tools like email or SMS alerts to ensure that alerts are received promptly, even when the administrator is not actively monitoring the system.
• Test in a Safe Environment: Before deploying the script in a production environment, test it in a controlled setting to ensure it behaves as expected with your specific log files and use cases.

Final Thoughts

Monitoring log files for specific text strings is a foundational practice in IT administration and security. This script provides a simple yet powerful solution for automating this process, making it easier for IT professionals to detect and respond to critical events in real time. For those using NinjaOne, this kind of script could be an integral part of your overall IT monitoring strategy, ensuring that your systems remain secure and operational at all times.