# Watch log dir for new file, automatically tail to slack

We have a process that outputs to log files in the format /var/log/xxx/YYYY_MM_DD.log - the file name is chosen programmatically and is not rotated using logrotate or anything like that. We want to automatically tail the latest file and pipe that to slackcat so that we can see the logs in a certain slack channel.

I came up with the following solution that works great, but I'm no bash expert so I am wondering if this could be simplified? The hardest part was avoiding zombie processes when something dies or gets killed, but I'd love to do this with one file instead of 2 also:

watchlogdir.sh

#!/bin/sh
trap "pkill -TERM -g $$; exit" INT TERM EXIT while true; do /root/tailtoslack.sh & PID=! echo PID echo$$
inotifywait -e create /var/log/xxx/
pkill -TERM -P $PID kill$PID
done


tailtoslack.sh

while true; do
FILETOWATCH=ls -t /var/log/xxx/*.log | head -1
tail $FILETOWATCH -f -n1 | grep -v "DEBUG:\|^$" --color=never --line-buffered | /root/slackcat &> /tmp/slackcat
sleep 31
done


The core of watchlogdir.sh, besides the interruption handling stuff, is using inotifywait to watch for a new file created in the log directory, and when that happens, killing tailtoslack.sh and respawning it so it can find the new file

tailtoslack.sh just looks for the latest file, and pipes that to slackcat after filtering out DEBUG lines and empty lines. the while loop here is because some lines in the error logs cause slackcat to crash, so this way if that happens it'll sleep for a little while and retry.

Without changing the requirements of how the log files are written, can any of this be done better?

This seems quite fine. Given your circumstances, I don't see how this can be done simpler.

The script could use a bit of tidying up though. The indentation of watchlogdir.sh is haphazard, it would be more readable to make it consistent. Oh I see now. It's the  that messes things up, your formatting is fine.

In the other script, this line could be written better:

FILETOWATCH=ls -t /var/log/xxx/*.log | head -1


By using $(...) instead of ... for command substitution, and using the canonical option -n1 instead of -1 with head: FILETOWATCH=$(ls -t /var/log/xxx/*.log | head -n1)

• thanks! As you can see, stackexchange seems to be doing something weird to the indentation, I can't figure out why but it is in fact sane in the actual file. – Jay Paroline Mar 5 '16 at 22:42
• uggh, I see. Amended my post – janos Mar 5 '16 at 22:58
• Don't parse the output of ls! At least use the -1 option to guarantee only one entry per line! – David Foerster Mar 6 '16 at 10:27
• @DavidFoerster I don't think that getting the first line of ls is really parsing. I think that recommendation concerns parsing the content of lines, especially the output of ls -l. I also don't see how -1 has an effect on the pipeline to | head -n1. As far as I know it only affects display in an interactive shell. Please do correct me if I'm wrong. – janos Mar 6 '16 at 10:35
• I never thought of the different defaults for interactive and non-interactive output. Makes sense though. +1 – David Foerster Mar 6 '16 at 11:02