檢查 /var/log/lastlog

#!/bin/bash
# /var/log/lastlog > 1g
_debug=;

mfile=/var/log/lastlog
archive_dir=/var/log

_f0=$(echo $0|tr \/ _)-$(echo ${*}|md5sum|awk '{print $1}');
exec 100> /tmp/${_f0}.lock
flock -n 100 || exit 1

echo $$ $(date +%Y%m%d-%H%M%S) $0 $* >&100

inotifywait -m ${mfile} |while read dir action file;
do [ -z "$file" ]&&_f=$dir||_f=${dir}/${file};
[ -z "$_debug" ]|| echo debug: $dir $action $file f=$_f;
a_f=$(basename $mfile).$(date +%Y%m%d-%H%M%S);
[ -z "$(ls -lh $_f|awk '{ print $5}'|grep G)" ]||{ lastlog >${archive_dir}/$a_f; :>$mfile; [ -z "$_debug" ]||echo "run..."; }
done;

---

#!/bin/bash
_lastlog=/var/log/lastlog
_lastarchive=/var/log/lastlog

[ -f $_lastlog ]||exit 0;
[ -z "$(ls -lh $_lastlog|awk '{print $5}'|grep G)" ]&& exit 0;
lastlog > ${_lastarchive}.$(date +%Y%m%d-%H%M%S);
:>$_lastlog;