jeff's picture

Being a perl "fan boy" from way back, I have a lot of small perl scripts lying around that I use to look through logs for something specific. We use Cacti and Nagios for "real" monitoring, but I've got scripts to see which email accounts have failed authentication attempts, who's logged into certain services in the past X days, how many connections our email server has rejected based on blacklisting, etc., etc.

Running these scripts would be simple except that we rotate and compress our logs. So while I would like to use the simple perl "magic open"while (<>) { ... }I can't if the log file is compressed.

This means I either run the script like this:
zcat log.1.gz log.2.gz log.3.gz | script.pl(and hope I never get nominated for a Useless Use of Cat award), or I add a bunch of code to the script to go through the @ARGV and open any compressed files by running them through 'gzip' first and open any "normal" files, well, "normally". So the actual script processing takes, literally, one line of perl code. But then there's ten lines to decide what kind of file this is and correctly open it for processing. ("Oh the shame!")

But in further proof that I'm not even worthy to untie Larry Wall's sandals, I recently came across this little snippet in the "Perl Tutorial on Opening Things" on perldoc.perl.org.
@ARGV = map { /\.(gz|Z)$/ ? "gzip -dc $_ |" : $_ } @ARGV;

Lions and Tigers and Bears, Oh My!

Now I can run script.pl /var/log/mail.log* and it processes all the "mail.log" files regardless of whether they are compressed or not. To quote the perldocs, It's not for nothing that this is called magic <ARG> . Pretty nifty, eh?