No. The bottom lines in the Corona688's post were the output produced by running the script he provided with an input file named logentryfile containing the sample data you showed us in post #4. If you want to parameterize his suggestion and read data from standard input (instead of from a file named logentryfile), change your script to something like:
Code:
#!/bin/bash
IAm=${0##*/}
if [ $# -ne 2 ]
then printf 'Usage: %s start end
where start and end are starting and ending dates and times in the format
"MM DD hh:mm:ss"
representing the start and end times to be selected from the logfile found
on standard input.
' "$IAm" >&2
exit 1
fi
awk -v FIRST="$1" -v LAST="$2" '
BEGIN {
split("Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec", A); # A[1]=Jan, etc
for(X in A) A[A[X]]=sprintf("%02d",X) # Convert A[1]=Jan to A[Jan]=01
}
{ $1=A[$1]
$2=sprintf("%02d", $2)
} # Substitute two digit months and days into first two fields
($0 >= FIRST) && ($0 <= LAST) # Select and print entries in range.'
When you invoke this script, give it two quoted operands containing your desired start and end dates and times and pipe the logfile you want it to process into it or, if the data is in a file, redirect the input to the script from that file.
Edit: Sorry I didn't see the text at the bottom of your code tags. Thank you so much for your help. So, as an example, assuming I wanted to find all IIS network traffic (port 80) I would type: scriptname "Mar27 10:00:00 10:10:00 DPT=80" <--- is this the correct format?
Last edited by vgplayer54; 03-29-2017 at 10:05 AM..
If your script is named myscript, is located in some directory in your utility search path (as indicated by the expansion of $PATH), and you want it to select records from a file named /var/log/messages and you want it to print out records with timestamps between 7:15 and 8:30 this morning, invoke it with:
As long as myscript is on your utility search path, it doesn't make any difference whether or not the script and the files it will be processing are in the same directory.
This User Gave Thanks to Don Cragun For This Post:
If your script is named myscript, is located in some directory in your utility search path (as indicated by the expansion of $PATH), and you want it to select records from a file named /var/log/messages and you want it to print out records with timestamps between 7:15 and 8:30 this morning, invoke it with:
As long as myscript is on your utility search path, it doesn't make any difference whether or not the script and the files it will be processing are in the same directory.
Ah perfect! But what of the port number variable? Would it work if I used the command you provided and piped it with a grep statement stating the port number? ie.
Ah perfect! But what of the port number variable? Would it work if I used the command you provided and piped it with a grep statement stating the port number? ie.
Please use CODE tags as required by forum rules when displaying sample input, sample output, and code segments.
Obviously, you can search for the string 80 in awk (if you'd like to pass your script some options or some more operands) or you can grep the output produced by the code I suggested, but I don' understand how searching for 80 in your sample input has anything to do with a port number. The string 80 in the sample data you provided will match on LEN=80 and on several different ID values such as ID=7802 and ID=1800 through ID=1806. Although it doesn't happen to match any parts of your sample data like the numbers between square brackets; parts of the SRC and DEST IP addresses; parts of the MAC addresses; and parts of the TOS, PREC, SPT, and DPT fields it certainly looks like any of those fields could provide a match and none of them seem to have anything to do with a port number.
Your original code also had searches for chains (which do not have any obvious entries in your sample data) and it prompts for an IN modifier, but has INPUT-DROPPEDIN=value and FORWARD-ACCEPTEDIN=value (but not just IN=value).
Note also that most lines in your sample data contain two LEN=value fields. If you wanted to match a LEN field, would it matter which one matched?
Before we talk about adding a chain of grep commands to a pipeline or adding code to the awk script to search for more patterns, please clearly describe what each of your patterns is supposed to match. (Are you hoping to match a basic regular expression, an extended regular expression, or a fixed string? Are you hoping to match a pattern if it matches any substring in a line, or to only match an entire "word" in a line?)
This User Gave Thanks to Don Cragun For This Post:
Obviously, you can search for the string 80 in awk (if you'd like to pass your script some options or some more operands) or you can grep the output produced by the code I suggested, but I don' understand how searching for 80 in your sample input has anything to do with a port number. The string 80 in the sample data you provided will match on LEN=80 and on several different ID values such as ID=7802 and ID=1800 through ID=1806. Although it doesn't happen to match any parts of your sample data like the numbers between square brackets; parts of the SRC and DEST IP addresses; parts of the MAC addresses; and parts of the TOS, PREC, SPT, and DPT fields it certainly looks like any of those fields could provide a match and none of them seem to have anything to do with a port number.
Your original code also had searches for chains (which do not have any obvious entries in your sample data) and it prompts for an IN modifier, but has INPUT-DROPPEDIN=value and FORWARD-ACCEPTEDIN=value (but not just IN=value).
Note also that most lines in your sample data contain two LEN=value fields. If you wanted to match a LEN field, would it matter which one matched?
Before we talk about adding a chain of grep commands to a pipeline or adding code to the awk script to search for more patterns, please clearly describe what each of your patterns is supposed to match. (Are you hoping to match a basic regular expression, an extended regular expression, or a fixed string? Are you hoping to match a pattern if it matches any substring in a line, or to only match an entire "word" in a line?)
Sorry for not being overly clear - what I am attempting to do is run traffic through my network on a variety of different ports (ie. HTTP traffic on port 80, SMTP on port 143, MySQL on port 1306, etc). Then, I will be asked a variety of questions including as an example: "Show me all MySQL traffic that went through your network on March 27 between 12:30pm and 12:35pm". This is what I need the script to do: I enter the name of the script on the command line followed by variables that specify the requested information. (ie. myscript Mar 27 12:30:00 12:35:00 port=1306) and it will display all MySQL traffic on that date between those times from the /var/log/messages file. Will the above posted script be able to do this? I am..not very good at scripting awk, not sure where to use that or how to make it work for port numbers.
Also you mentioned the INPUT-DROPPED and FORWARD-ACCEPTED before from my first script, those are just chains within my iptables. I do not think they should be related to the script as it would be locating all network traffic, both dropped and accepted.
Sorry for not being overly clear - what I am attempting to do is run traffic through my network on a variety of different ports (ie. HTTP traffic on port 80, SMTP on port 143, MySQL on port 1306, etc). Then, I will be asked a variety of questions including as an example: "Show me all MySQL traffic that went through your network on March 27 between 12:30pm and 12:35pm". This is what I need the script to do: I enter the name of the script on the command line followed by variables that specify the requested information. (ie. myscript Mar 27 12:30:00 12:35:00 port=1306) and it will display all MySQL traffic on that date between those times from the /var/log/messages file. Will the above posted script be able to do this? I am..not very good at scripting awk, not sure where to use that or how to make it work for port numbers.
Also you mentioned the INPUT-DROPPED and FORWARD-ACCEPTED before from my first script, those are just chains within my iptables. I do not think they should be related to the script as it would be locating all network traffic, both dropped and accepted.
I don't care whether or not you know awk (although I would hope that you are making an attempt to learn how to use it if you want to process the types of data you're asking us to help you learn how to handle). But, I do expect you to know be able to answer questions about your data and I expect you to be able to describe how you want to process your data.
Given your data (which you provided in post #4 in this thread), please show us where the port number you want to use to select records is located within those records.
If you want to select records based on chains, please explain how a chain is identified in your data.
The code you showed us used case-insensitive searches, but there doesn't seem to be any inconsistency in case in your data. Do you need case-insensitive search capabiliities?
When you pass search criteria to your script, do you expect the script to treat those criteria as regular expressions or as fixed strings?
I can almost write awk scripts in my sleep, but I can't write a script to process data in any language if I don't understand what it is that I'm trying to do.
I don't care whether or not you know awk (although I would hope that you are making an attempt to learn how to use it if you want to process the types of data you're asking us to help you learn how to handle). But, I do expect you to know be able to answer questions about your data and I expect you to be able to describe how you want to process your data.
Given your data (which you provided in post #4 in this thread), please show us where the port number you want to use to select records is located within those records.
If you want to select records based on chains, please explain how a chain is identified in your data.
The code you showed us used case-insensitive searches, but there doesn't seem to be any inconsistency in case in your data. Do you need case-insensitive search capabiliities?
When you pass search criteria to your script, do you expect the script to treat those criteria as regular expressions or as fixed strings?
I can almost write awk scripts in my sleep, but I can't write a script to process data in any language if I don't understand what it is that I'm trying to do.
Sure, thank you for your help.
1.The port numbers are located within the /var/log/messages divided by how the port was used (ie. DPT=80 for incoming HTTP traffic or SPT=143 for outgoing mail traffic) Using only those two prefixes should be fine...such as
Code:
*PT=$portnumber
and have the user enter the variable for the port number.
2.No need for this, /var/log/messages includes all chain traffic which is what I want. No need to divide them by chain.
3.Case insensitive capabilities would be a bonus if you can make it possible! But I can definitely live without it.
4. I'm going to say fixed strings here, I don't believe there's a need for the script to search using regular expressions.
I am trying to create a script that checks if my VPN connection is up and running...
Everything seems to work as except but for some reason, the script fills up my /var/log/auth.log with the below information
Dec 13 01:07:44 debian sudo: soichiro : TTY=pts/0 ; PWD=/home/soichiro/Desktop ;... (5 Replies)
I have been searching and reading about syslog. I would like to know how to Transfer the logs being thrown into /var/log/messages into another file example /var/log/volumelog.
tail -f /var/log/messages
dblogger: msg_to_dbrow: no logtype using missing
dblogger: msg_to_dbrow_str: val ==... (2 Replies)
Below is my script to log all the command input by any user to /var/log/messages. But I cant achieve the desired output that i want. PLease see below.
function log2syslog
{
declare COMMAND
COMMAND=$(fc -ln -0)
logger -p local1.notice -t bash -i -- "$USER:$COMMAND"
}
trap... (12 Replies)
Hello All,
I want to write a script to monitor my product logs from /var/log/messages and send notifications without using "tail -f" command.Please suggest alternatives and any other tools for monitoring and alerting.
Thank You (1 Reply)
Whenever a user uses su I get the following error messages in /var/log/messages:
Nov 23 04:24:55 <REMOVED> abrt: saved core dump of pid 26141 (/usr/libexec/fprintd) to /var/spool/abrt/ccpp-1322018695-26141.new/coredump (753664 bytes)
Nov 23 04:24:55 <REMOVED> abrtd: Directory... (3 Replies)
So I want the DBA to access /var/log/messages and so I logged in as root and then edited the sudoers file as follows
"oracle ALL= (root) /bin/view, /var/log/messages"
However when I login as oracle and try
"sudo more /var/log/messages" I get
Sorry, user oracle is not allowed to... (1 Reply)
How can view log messages between two time frame from /var/log/message or any type of log files.
when logfiles are very big and especially many messages with in few minutes, I would like to display log messages between 5 minute interval.
Could you pls give me the command? (1 Reply)
The /var/adm/messages in Solaris seem to log more system messages/errors compared to /var/log/messages in Linux.
I checked the log level in Linux and they seem OK.
Is there any other log file that contains the messages or is it just that Linux doesn't log great many things? (2 Replies)
hi sirs
can u tell the difference between /var/log/syslogs and /var/adm/messages
in my working place i am having two servers.
in one servers messages file is empty and syslog file is going on increasing..
and in another servers message file is going on increasing but syslog file is... (2 Replies)
03-29-2017
