correct logic for piped egrep/grep

[ivanachukapawn]

In this code:

egrep -i "`date '+%b %e'`" /var/log/messages|egrep -i "failure|panic|error"|grep -v "uid=0"

RETURN_VALUE=$?


if [ $RETURN_VALUE -eq 0  ]; then

I want to grep for failure|panic|error messages but not if UID=0. My question has to do with the return value. If I have failure and panic and error messages in the log but the UID is > 0 on all these hits, will my return value = 0? Another way to ask this question is: will the return value be for the last command in the pipe? and a third and pragmatic way to ask this question is: Is this coded correctly so as to return a 0 for any failure|panic|error messages even if all the hits have UID > 0?

[atreyu]

If I have failure and panic and error messages in the log but the UID is > 0 on all these hits, will my return value = 0?

yes

will the return value be for the last command in the pipe?

yes

Is this coded correctly so as to return a 0 for any failure|panic|error messages even if all the hits have UID > 0?

yes, but is that what you want? it seems like you want to know if there are any failure/panic/warn messages that ARE uid=0. the way you have it now, the last grep would mask the presence of any uid=0 entries by ignoring them (-v). I think what you want is something like:

egrep -i "`date '+%b %e'`" /var/log/messages|egrep -i "failure|panic|error"|grep "uid=0"

RETURN_VALUE=$?

if [ $RETURN_VALUE -eq 1  ]; then
  echo Something was found in the log
else
  echo Nothing to report
fi

or am i mis-understaing?

[ivanachukapawn]

Thank you for your reply Atreyu (is your handle an allusion to the NeverEndingStory?) - Actually, I wanted to detect any of these errors only if the UID -ne 0 and I was concerned that somehow the grep -v "uid=0" would screw up the return code. I guess I am hallucinating. Sorry.

[atreyu]

but your first question was if all warnings were UID > 0 would it return 0. It will, but it will also return 0 if there are multiple warnings and one of them IS uid=0. so what you really mean is if ANY warnings are uid > 0, yes?

and yes, it is a NES ref, not a rock band ref (i beat them to it).