An exit status of 0 is not an empty log

The status is the process result

When a summarizer finishes, the shell records an exit status. Zero usually means the process did not hit a failure it treats as fatal. That is a fact about the process. It is not a fact about every byte of the log you hoped it would read.

A non-zero status is also only the process result. It does not name which line matched. Read the streams before you describe the log.

Stdout and stderr are the rest of the run

Matching rows, if the script prints them, are on stdout. Warnings such as a file it skipped are often on stderr. A clean stdout with a skip warning is not “nothing happened in the log.” The skipped file was not in the result.

If you saved only the status, write “streams not saved.” Do not reconstruct a quiet log from a zero.

What to write down

File the command’s input paths, the exit status, and a short quote from each stream you kept. Say which files the script says it opened. A sentence about the log’s contents has to come from stdout, not from the status alone.

Lab: a zero beside a skipped file

A lab run of the auth summarizer exits 0. Stdout is one line: files-read: 1. Stderr says auth.log.1: not opened. A draft says the host had no failed logins because the status was 0.

The note quotes status 0, files-read 1, and the stderr line. The rotated file was not opened. The status does not describe that file. Failed logins are not claimed, and they are not ruled out for the skipped file.

exit status: 0
stdout: files-read: 1
stderr: auth.log.1: not opened
write: one file read, one file skipped
not: the host had no failed logins