OAuth — alert on callback-endpoint error climb

#!/usr/bin/env bash
# /etc/cron.d/oauth-callback
# */1 * * * * root /opt/oauth-callback.sh

LOG=${LOG:-/var/log/nginx/access.log}
PATH_REGEX=${PATH_REGEX:-/auth/callback}
WINDOW=60
ERR_PCT=${ERR_PCT:-10}                # alert when 4xx > 10 %
SINCE=$(date -d "-${WINDOW} seconds" '+%d/%b/%Y:%H:%M:%S')

read TOTAL ERR < <(awk -v since="$SINCE" -v re="$PATH_REGEX" '
  $4 >= "["since && $7 ~ re {
    t++
    if ($9 ~ /^4/) e++
  }
  END { print t+0, e+0 }
' "$LOG")

[ "$TOTAL" -lt 5 ] && exit 0          # too few requests to judge

PCT=$((ERR * 100 / TOTAL))
if [ "$PCT" -gt "$ERR_PCT" ]; then
  curl -fsS "$HEARTBEAT_URL" --data "oauth_4xx=${PCT}%,total=$TOTAL"
  exit 2
fi
echo "OK (${PCT}% 4xx)"