Home / ubuntu / Questions / 1309176
Accepted
Harsha
Asked: 2021-01-19 21:18:50 +0800 CST

Inotifywait apply regex pattern on changes in a file

  • 772

Requirement: Alert if there is any package installed or removed in the ubuntu server.

For this requirement, I'm trying to use inotifywait to continuously monitor dpkg.log, if there are any changes using regex pattern for installed and removed package and alert based on that.

How can I take the modified content of a file which is being monitored by inotifywait to another file or store it in a variable, so that I can apply some regex and alert based on that?

Please help me how can I do this, or Is there any other way that I can achieve this requirement using any other tool.

This is what I was trying but this is not working.

  #!/bin/sh
   while inotifywait -e modify /var/log/dpkg.log; do   
      if tail -n1 /var/log/dpkg.log | grep installed; then
         // alert script    
       fi 
    done
command-line

1 Answers

  1. Best Answer

    This script using diff works:

    #!/bin/bash

# Save contents of dpkg.log
last_content=$(</var/log/dpkg.log)

# Loop inotifywait
while inotifywait -e modify /var/log/dpkg.log; do
    # Check diff between dpkg.log and last saved content.
    # Use grep to filter lines not interesting
    # save in a variabler called "diff".
    diff=$(diff /var/log/dpkg.log <(printf '%s' "$last_content") | grep '^<' | grep "status installed")

    # Check if the command to check "diff" succeeded ($? == 0)
    # if yes, run the alert:
    if [ $? -eq 0 ]; then
        echo "$diff"
        notify-send "$(printf '%s' "$diff" | grep -Po "status installed \K.*") has been installed"
    fi

    # Save contents of dpkg.log
    last_content=$(</var/log/dpkg.log)
done

    Instead of notify-send, you can of course use any other method for alert.

    • 1