This is on a HP-UX system.

I need to merge the 2 reports, for each line in syslog I need to lookup who was logged in to the pts/# based on the time from the last.txt report.

Here is what I get from sulog.log

cat syslog | grep "su:" | grep "Jun 14"


Jul 14 08:02:48 server1 su: - 2 user1-root
Jul 14 09:13:23 server1 su: + 2 user1-root
Jul 14 12:03:03 server1 su: + 2 user1-root
Jul 14 18:15:13 server1 su: + 3 user2-root
Jul 14 15:03:01 server1 su: + 4 user7-root

- 2 = pts/2
+ 2 = pts/2
+ 3 = pts/3
etc....





This is from last report:

head last.txt | grep "Jul 14"
user1 pts/2 10.0.0.1 Thu Jul 14 08:00 - 10:00 (02:00)
user1 pts/2 10.0.0.2 Thu Jul 14 11:00 - 13:00 (02:00)
user2 pts/3 10.0.0.3 Wed Jul 14 16:00 - 20:00 (04:00)
user7 pts/4 hostx Wed Jul 14 13:25 - 16:01 (02:35)
.
.
.
.

So I could get:

Jul 14 08:02:48 server1 su: - 2 user1-root 10.0.0.1
Jul 14 09:13:23 server1 su: + 2 user1-root 10.0.0.1
Jul 14 12:03:03 server1 su: + 2 user1-root 10.0.0.2
Jul 14 18:15:13 server1 su: + 3 user2-root 10.0.0.3
Jul 14 15:03:01 server1 su: + 4 user7-root hostx

Any assistance would be great.

If you have the first output in file1 and the second output in file2:

awk '
NR==FNR{split($2,s,"/");i=s[2];a[i]=$3;next}
a[$7]{$0=$0 FS a[$7]}
{print}
' file2 file1

You Rock, that works great...

A couple questions...
Im still learing awk... Can you explain how this works.. What its doing so I dont have to ask about other scripts in the future and I can help others more.

really appreciate it.

awk '
NR==FNR{split($2,s,"/");i=s[2];a[i]=$3;next}
a[$7]{$0=$0 FS a[$7]}
{print}
' file2 file1

NR==FNR{split($2,s,"/");i=s[2];a[i]=$3;next}

a[$7]{$0=$0 FS a[$7]}
{print}

ok there is a problem, there is no check based on time.

I would need to check to see who was logged into the pts/# based on what time it was logged.

I know I can do it in perl, but would rather not.

if I have:

Jul 14 08:02:48 server1 su: - 0 user1-root
Jul 14 09:13:23 server1 su: + 0 user1-root
Jul 14 12:03:03 server1 su: + 0 user1-root
Jul 14 18:15:13 server1 su: + 0 user2-root
Jul 14 15:03:01 server1 su: + 0 user7-root


and


user1 pts/0 10.0.0.1 Thu Jul 14 08:00 - 10:00 (02:00)
user1 pts/0 10.0.0.2 Thu Jul 14 11:00 - 13:00 (02:00)
user2 pts/0 10.0.0.3 Wed Jul 14 16:00 - 20:00 (04:00)
user7 pts/0 hostx Wed Jul 14 13:25 - 15:01 (02:35)

I get:

Jul 14 08:02:48 server1 su: - 0 user1-root hostx
Jul 14 09:13:23 server1 su: + 0 user1-root hostx
Jul 14 12:03:03 server1 su: + 0 user1-root hostx
Jul 14 18:15:13 server1 su: + 0 user2-root hostx
Jul 14 15:03:01 server1 su: + 0 user7-root hostx

You must have one or more common fields (a key) in both files to join the files.

Regards

Common fields

Username: "userX" = "userX"-xxxxxxxx

pts: pts/"#" = - "#" userX.......

Time: ##:##:## within ##:## - ##:##

that wont be enough?