I am using fetchmail in combination with procmail for mail filtering on CentOS where my mail contains various log messages.They serve me so I could search through my mail(logs) for error strings. So does anyone haves an idea how could I check if one mail is missing because I have a fixed number of mail sent to me every day, and if a server crashes obviously it won't send the mail, how can I determine if a mail is missing and if it is to send an alert through email?When I get my mail with fetchmail and process it with procmail I need to look through procmail.log file so I could determine if a certain mail hasn't arrived. My log file looks like this:From root1@example1.com  Wed Dec 31 10:38:49 2014 Subject: example1 -> Incremental 1 -> DEV backup  Folder: /dev/null                                                      235603From root2@example2.yu  Wed Dec 31 10:38:50 2014 Subject: example2  Folder: /dev/null                                                        5983From root3@example3.yu  Wed Dec 31 10:38:50 2014 Subject: example3 -> Full Offline Backup DEV  Folder: /dev/null                                                       40978From xenbackup@example4.rs  Wed Dec 31 10:38:50 2014 Subject: [OK] [ example4]  Folder: /dev/nullSo these mails are received during a day, and they must be there at a certain time when I need to check if every mail has arrived (exists in the log file). Now I need a way to see if each of these mails are present in the log. And it can be searched just by the from line.
Checking if a mail has arrived, if not then alert
centos;logs;email;procmail;fetchmail
You can run a periodic log analyzer of some sort to verify that you have received everything you expect to receive.  Perhaps something like this.awk 'BEGIN {      e=root1@example1.com:root2@example2.yu:root3@example3.yu:xenbackup@example4.rs;      split(e, expected, /:/) }  /^From / { seen[$2]++ }  END { for (x in expected) if (!(expected[x] in seen)) print expected[x]  missing }  ' Mail/procmail.logMake sure you have a log from the period of time you want to check (last 24 hours?) and pass it to this script.  If one of the expected records is missing, it will alert.The script simply looks for the second field of each From log line and extracts it into seen.  At the end, if there are records in expected which are not in seen, issue an alert message for each.You could run this out of your crontab to have an email delivered to you if the script generates any output.  It would make sense to run this in conjuction with a log rotation script so that you archive and process your latest log file (at least roughly) at the same time.  Then you don't need to parse time stamps in the log file, etc; anything which is in this log file is for the period you are interested in.