#!/bin/bash
#
# script by nate campi <nate@campin.net>
# this script will send out an email alert no more
# often than every half hour - provided you supply the same
# argument to it for the "ALERT_MESSAGE"
#
#  - use it however you want - freeware
#
# The first argument "ALERT_MESSAGE" needs to be one word -
# it is the name used for the file that's used to measure how long it
# has been since this alert was last triggered. It is also the subject
# of the email message, so make it descriptive.
#
# this should work on any unix-like OS, if you fix the paths - 
# as written it works on redhat linux 7.0.
#

if [ $# -lt 2 ]; then
  echo 1>&2 "Usage: $0 ALERT_MESSAGE email@address"
  exit 1
fi

# change this if you want, but no world-writable dirs like /tmp or /var/tmp
pushd /root/swatch

# this line enables the extended globbing in bash to make this possible,
# you'll need a recent bash for this
shopt -s extglob

DATE_NOW=`/bin/date +%s`
REGEX_FILE="$1"
MAILTO="$2"

if [ -f ${REGEX_FILE} ]
then
        THROTTLE_FILE_MTIME=`/usr/bin/stat -t ${REGEX_FILE} | /usr/bin/awk '{print $13}'
`
	# 1800 seconds is half an hour - change it to another time period if you want
        if [ `/usr/bin/expr $DATE_NOW - $THROTTLE_FILE_MTIME` -lt 1800 ]
        then
                # our work here is done
                exit 0
        else
                /usr/bin/touch ${REGEX_FILE}
        fi
else
        /usr/bin/touch ${REGEX_FILE}
fi

while read LOGLINE
do
        echo ${LOGLINE/+([0-9<>])} | /usr/bin/mail -s"Syslog Alert: $REGEX_FILE " $MAILTO
done

popd