Re: My awking buddies. (174 Views)
Reply
Super Advisor
Belinda Dermody
Posts: 352
Registered: ‎05-14-1996
Message 1 of 15 (174 Views)
Accepted Solution

My awking buddies.

I am trying to use the current MM DD variable with a awk command within a script, extracting current days sudo usage, each entry is two lines.

I get the following to work but the date is hard coded.
awk '/Nov 10/ {print $0; for (i=1;i<2;i++) {getline;print $0; } }' /var/log/sudo.log

I want to set the date for each run with the CDATE=`date "+%b %d"` and beable to use the $CDATE instead of Nov 10 as above.
Please use plain text.
Honored Contributor
Geoff Wild
Posts: 7,168
Registered: ‎06-04-2001
Message 2 of 15 (174 Views)

Re: My awking buddies.

Try:

awk '/'"$CDATE"'/ {print $0; for (i=1;i<2;i++) {getline;print $0; } }' /var/log/sudo.log


Rgds...Geoff
Proverbs 3:5,6 Trust in the Lord with all your heart and lean not on your own understanding; in all your ways acknowledge him, and he will make all your paths straight.
Please use plain text.
Honored Contributor
Rick Garland
Posts: 4,470
Registered: ‎06-25-1997
Message 3 of 15 (174 Views)

Re: My awking buddies.

Here is a script that I wrote a few years ago. I believe it is doing what you want.
Modify for your use and preferences.

Note; Later versions of the sudo.log have a different layout of the file. The result is that this script will pull values that are no longer in this position.

Please use plain text.
Super Advisor
Belinda Dermody
Posts: 352
Registered: ‎05-14-1996
Message 4 of 15 (174 Views)

Re: My awking buddies.

Geoff I have already tried that, the preceeding ' nullifies all the special characters so the $ is not translated..
Please use plain text.
Acclaimed Contributor
James R. Ferguson
Posts: 21,184
Registered: ‎07-06-2000
Message 5 of 15 (174 Views)

Re: My awking buddies.

James:

One way:

# CDATE1=`date +%b`
# CDATE2=`date +%d`
# awk $1~CDATE1 && $2~CDATE2 {print $0;for (i=1;i<2;i++) {getline;print $0;}}' CDATE1=${CDATE1} CDATE2=${CDATE2} /var/log/sudo.log

You will need to change $1 and $2 to match the actual field numbers in you record.

Regards!

...JRF...
Please use plain text.
Super Advisor
Belinda Dermody
Posts: 352
Registered: ‎05-14-1996
Message 6 of 15 (174 Views)

Re: My awking buddies.

Jim, good to hear from you again, I get the good ole bail out in awk using your suggestion. See the attached word doc...
Please use plain text.
Acclaimed Contributor
James R. Ferguson
Posts: 21,184
Registered: ‎07-06-2000
Message 7 of 15 (174 Views)

Re: My awking buddies.

Hi (again) James:

Sorry, looks like I transposed a "'". Try:

# awk '$1~CDATE1 && $2~CDATE2 {print $0; for (i=1;i<2;i++) {getline;print $0;}}' CDATE1=${CDATE1} CDATE2=${CDATE2} /var/log/sudo.log

Regards!

...JRF...
Please use plain text.
Honored Contributor
Sandman!
Posts: 2,220
Registered: ‎01-13-2005
Message 8 of 15 (174 Views)

Re: My awking buddies.

How about...

# CDATE=`date "+%b %d"`

# awk '$0 ~ cdt {print $0;for(i=1;i<2;i++) {getline;print $0}}' cdt="$CDATE" /var/log/sudo.log

cheers!
Please use plain text.
Super Advisor
Belinda Dermody
Posts: 352
Registered: ‎05-14-1996
Message 9 of 15 (174 Views)

Re: My awking buddies.

Still getting bailouts
Please use plain text.
Acclaimed Contributor
James R. Ferguson
Posts: 21,184
Registered: ‎07-06-2000
Message 10 of 15 (174 Views)

Re: My awking buddies.

Hi James:

My second post seems to work in my hands if I cut-and-paste from this site. Are you still getting syntax errors? No points if "yes" and/or at your discretion.

Regards!

...JRF...
Please use plain text.
Honored Contributor
Geoff Wild
Posts: 7,168
Registered: ‎06-04-2001
Message 11 of 15 (174 Views)

Re: My awking buddies.

What about adding the carrot ^:

Try:

awk '/^'"$CDATE"'/ {print $0; for (i=1;i<2;i++) {getline;print $0; } }' /var/log/sudo.log


Rgds...Geoff
Proverbs 3:5,6 Trust in the Lord with all your heart and lean not on your own understanding; in all your ways acknowledge him, and he will make all your paths straight.
Please use plain text.
Super Advisor
Belinda Dermody
Posts: 352
Registered: ‎05-14-1996
Message 12 of 15 (174 Views)

Re: My awking buddies.

Jim, you are right, I maintain HP and Sun systems, it works ok from the command line on the HP system but I get bail out on the Sun system runnning Solaris 10. My HP sudo logs are one liners so I have no problem with those sysems, it is the new Sun systems that were dropped in my lap..
Please use plain text.
Super Advisor
Belinda Dermody
Posts: 352
Registered: ‎05-14-1996
Message 13 of 15 (174 Views)

Re: My awking buddies.

Ok Jim, if I use nawk on the Solaris system with your help I get the results, as always guys I knew you would be it to death and come up with the correct answer...
Please use plain text.
Acclaimed Contributor
James R. Ferguson
Posts: 21,184
Registered: ‎07-06-2000
Message 14 of 15 (174 Views)

Re: My awking buddies.

Hi James:

OK. There is another syntax to pass external variable. It uses '-v'. Try this:

# awk -v CDATE1=${CDATE1} -v CDATE2=${CDATE2} '$1~CDATE1 && $2~CDATE2 {print $0; for (i=1;i<2;i++) {getline;print $0;}}' /var/log/sudo.log

Regards!

...JRF...

Please use plain text.
Super Advisor
Belinda Dermody
Posts: 352
Registered: ‎05-14-1996
Message 15 of 15 (174 Views)

Re: My awking buddies.

Boy, I just read my closure, need a editor to verify what I wrote. Meant to say with all your help beating it to death we came up with the correct answer. I am not trying anything else, I have a stress headache already and if it works don't change it...
Please use plain text.
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation