Small System Monitoring Script

Here is a short shell script to show last logins from SSH, XRDP, SUDO and Cockpit. In addition it show potential disk problems from S.M.A.R.T.

#!/bin/sh

default_since='-1days'
default_priority=info

read -r -d "" data << END_OF_DATA
System login         ^ systemd-logind          ^ info  ^         ^ New session 
XRDP                 ^ xrdp-sesman             ^ debug ^ -5days  ^ logged in|Received system login request
Cockpit login        ^ cockpit-session         ^       ^         ^ session opened
SUDO                 ^ sudo                    ^       ^         ^ session opened
Storage problems     ^ smartd                  ^       ^ -1days  ^ uncorrectable|unreadable
END_OF_DATA

trim() {
    local s="$*"
    
    # remove leading whitespace
    s="${s#"${s%%[![:space:]]*}"}"
    
    # remove trailing whitespace
    s="${s%"${s##*[![:space:]]}"}"
    
    printf '%s' "$s"
}

IFS="^"
echo "$data" | while read title slid priority since grep; do
	effective_since=$default_since
	effective_priority=$default_priority
	
	[[ -n "$(trim $since)" ]] && effective_since="$(trim $since)"
	[[ -n "$(trim $priority)" ]] && effective_priority="$(trim $priority)"

	echo "$(trim $title)"
	journalctl \
		--no-pager \
		--no-tail \
		--since $effective_since \
		--priority $effective_priority \
		--reverse \
		--grep "$(trim $grep)" \
		-- SYSLOG_IDENTIFIER="$(trim $slid)"

	echo; echo
done

I made it with the help of Cockpit Logs feature that shows the actual command being executed based on how you configure it.

The most important part of the script is the journalctl command. Everything else are defaults, the list of desired syslog identifiers and what to extract from them, and output formatting.