Simple Expect script question

[adam35413]

I am trying to detect that a command was logged in my audit logs. To accomplish this, I am just tailing the log until either the expected entry appears or expect times out:

send "tail -f /var/log/messages"
expect "SYSCALL=foo*uid=bar"

However, to do this I need to send the ^C (interrupt) command after I have found the entry I am looking for, otherwise tail will sit there until the timeout. How do I send interrupts?

[wje_lf]

I need to send the ^C (interrupt) command

No ya don't.

What happens when you run this script?

#!/bin/sh

cat > dog <<EOD
abcde
asdf
EOD

cat > mouse <<EOD
12345
qwerty
EOD

expect <<EOD
spawn tail -f dog
set timeout 10
expect asdf
EOD

expect <<EOD
spawn tail -f mouse
set timeout 10
expect asdf
EOD