Sponsored Content
Full Discussion: Extract IP addresses
Top Forums Shell Programming and Scripting Extract IP addresses Post 302300372 by hazno on Tuesday 24th of March 2009 03:12:09 AM
Old 03-24-2009
Extract IP addresses

The only way I could extract the user names and 'from' IP addresses is to use a few temp files. Split up by 'Failed keyboard-interactive' and 'Failed password'.

Anyone have any idea to do this all in one go?

Code:
aaa.bbb.ccc.ddd   2009-03-23 01:28:33     sshd[16272]: Failed keyboard-interactive/pam for invalid user jkljlkjlj from 111.222.333.444 port 52095 ssh2
aaa.bbb.ccc.ddd  2009-03-23 03:33:10     sshd[16648]: Failed password for invalid user oracle from 222.333.444.555 port 29093 ssh2
aaa.bbb.ccc.ddd   2009-03-23 05:23:53     sshd[17589]: Failed password for root from 333.444.555.666 port 59095 ssh2

Ideally, I am looking at the following columns:

Timestamp UserName SourceIP

From both of these 2 types of authentication log entries.
 

10 More Discussions You Might Find Interesting

1. IP Networking

Finding IP Addresses

Is there anyway to tell what my NT IP is while logging into my UNIX box. I have users accessing our NT network and then telneting into our Unix Box. I would like to restrict access somehow. My who commands only returns the users name and pts device which changes. (1 Reply)
Discussion started by: golfs4us
1 Replies

2. UNIX for Dummies Questions & Answers

Hardware Addresses

can anyone tell me the procedure to view the MAC address for a system using linux (1 Reply)
Discussion started by: tcat
1 Replies

3. IP Networking

ip addresses

this might sound corny but i need help finding out about finding a persons ip address can u halp? and another question what the hell does ping mean??? thank u. (2 Replies)
Discussion started by: dragonslayer100
2 Replies

4. IP Networking

Ip Addresses

I'm not exactly sure what I can do with IPs... my friend won't tell me(don't ask me why, I figure it's cause he doesn't know either, hehe). I'm curious as to what theya re used for other than networking computers... if there IS any other purpose or use for them. That's all. --Evil_d00d (4 Replies)
Discussion started by: evil_d00d
4 Replies

5. UNIX and Linux Applications

email addresses

Greetings to all. I have installed dadamail on my web site and it works extremely well. I have two questions: 1. I have modified dada to bounce bad emails, but only the first newsletter will use the modifications. If I create another list, it doesn't use the modification. What gives? 2. Are... (0 Replies)
Discussion started by: okbrowder
0 Replies

6. UNIX for Dummies Questions & Answers

Different ip addresses

Hello! I have logged in using Putty into another machine 'tele'. The ip address which i used to login to 'tele' is 192.168.1.3. Now while at 'tele' when i run "#ifconfig -a" i get the same ip address i.e, 192.168.1.3. But when i run "#arp tele" it gives the output: tele (10.143.128.8) ... (9 Replies)
Discussion started by: suhail.sadaqat
9 Replies

7. Shell Programming and Scripting

Need help with IP and MAC addresses

Hi, i am working on a project where i have to write a script to find out MAC addresses of the systems with given IP address. Can anybody tell me which command i can use to find MAC address if you know IP address of the machine. Thanks (5 Replies)
Discussion started by: manmeet
5 Replies

8. IP Networking

Virtual IP addresses

How would i create virtual interface in linux to configure more than one IP address for a physical interface? any help wll be appreciated. https://www.unix.com/images/misc/progress.gif (1 Reply)
Discussion started by: salil2012
1 Replies

9. Shell Programming and Scripting

Extract list of IP addresses from a text file.

I have an xml file with IP addresses all over the show. I want to print only the IP addresses and cut off any text before or after the IP address. Example: Note: The IP addresses (x.x.x.x) do not consistently appear in the xml file as per the pattern below. Sometimes there are text before... (8 Replies)
Discussion started by: lewk
8 Replies

10. Shell Programming and Scripting

Extract e-mail addresses on a page

Hi I normally ask questions on coding but I think there is a code that can do this. I have regular text throughout my file and I want to extract all e-mail addresses from it (rather than going and searching each one). E-mails all have @ so I assume there is a way. Thanks Phil (6 Replies)
Discussion started by: phil_heath
6 Replies
DtSearchQuery(library call)											       DtSearchQuery(library call)

NAME
DtSearchQuery -- Perform a DtSearch database search for a specified query SYNOPSIS
#include <Dt/Search.h> int DtSearchQuery( void *qry, char *dbname, int search_type, char *date1, char *date2, DtSrResult **results, long *resultscount, char *stems, int *stemcount); DESCRIPTION
DtSearchQuery is the DtSearch API search function. DtSearchQuery is passed a query string and some search options, performs the requested search, and if successful returns a linked list of DtSrResult structures representing the documents satisfying the search. The results list contains information about the documents that can be used for subsequent retrievals, as well as information suitable for display to an end user. Search Types DtSearchQuery supports three types of searches: P, W, and S. Type P Search Query Strings Query strings for search type P have the simplest syntax, namely a sequence of words separated by ASCII whitespace. Punctuation and invalid words are silently discarded by the search engine. The only possible syntax error is that all query words happen to be invalid in the lan- guage of the database. Search type P is often used to implement a limited Query-by-Example (QBE) search paradigm. In this scenario, users typically paste document text from whatever source into a query string text field. Their expectation is that the search engine will return the documents in the database that are "most similar" to the text of the query string, and the statistical sort of the results list usually satisfies that expectation. Note that although search type P does not use boolean syntax, it is actually implemented as a stemmed search (type S search) with implied boolean ORs between words. Types S and W Boolean Query Strings Query strings for search types S (stemmed boolean) and W (exact word boolean) must be syntactically valid boolean expressions as described below. Any string that does not match a valid expression rule is invalid and will fail with an error message. Query words for all search types may be entered in any codeset for a supported DtSearch language, including multibyte languages. Words may be identified as invalid by the language module of the database for a number of reasons including any words that would not have been indexed because they are too short, too long, on the stop list, etc. With one exception, linguistically invalid words result in a syntax error. The exception is in the case of an "all ANDs" query, where invalid words and valid words that happen not to be in the database are silently erased from the query string. The boolean query operators are the ASCII metacharacters: '&' for AND, '|' for OR, '~' for NOT, '(' and ')' for open and close parentheses respectively, and '@ nnn' for collocation expressions. All expression tokens are separated by ASCII whitespace. Typically this i 1 or more space or tab characters. Omitting whitespace separators is legal if it can be done unambiguously. For example "word1&word2" is a legal expression but "word1word2" would be interpreted as a single word token. The ASCII "at" sign (@) marks a special boolean collocation operator. The collocation operator has the syntax "@n...", the ASCII "at" sign followed by one or more ASCII numeric digits, representing an integer with value greater than zero. Collocation is a variation of the AND search where a user can specify the maximum distance in bytes between any two words. In most languages a byte is equivalent to a character position. For example to find "ice" and "cream" separated by no more than five characters, the search query "ice @5 cream" may be used. Unlike other boolean operators, the collocation operator can apply only to naked word tokens, not other expressions. Searches including collocation operators are slower than searches without them, and can be much slower for common words. There are a maximum of 8 distinct word tokens. Collocation operators count as part of the 8. There is no limit to the number of operators, as long as they match the syntax rules. Note: Collocation operators are only supported for "Austext flavor" databases. The default flavor of database created by dtsrcreate is "Dtinfo flavor," which does not support collocation. Boolean Query Syntax Rules There are only 6 syntax rules and the rules are recursive. Ambiguity is resolved by precedence and associativity rules. 1. valid_expression := word_token A valid expression can be just a valid naked word token. Semantically, the expression returns all documents containing the speci- fied word. The word_token must be a valid word in the language of the database being searched. 2. valid_expression := valid_expression '&' valid_expression The ASCII ampersand character is the AND character. Semantically, it returns all documents satisfying both the first and second expressions (boolean intersection). AND is also the "implied" boolean operator in the following sense: the query parser will insert an ampersand between words or expressions that otherwise would be separated only by whitespace. For example "word1 word2" becomes "word1 & word2". 3. valid_expression := valid_expression '|' valid_expression The ASCII virgule (vertical slash) character is the OR character. It means return all documents satisfying either the first or the second expression (boolean union). 4. valid_expression := '(' valid_expression ')' Valid expressions may be recursively nested in ASCII open and close parentheses characters. The query parser "forgives" two com- mon human errors. It will automatically discard excessive close parentheses characters, and it will automatically generate close parentheses characters if necessary at the end of a query. For example, "aaa | (bbb & ccc)))))) ddd" becomes "aaa | ( bbb & ccc) & ddd", and "aaa ((bbbb" becomes "aaa ( ( bbb ) )". 5. valid_expression := '~' valid_expression The ASCII tilde character is the unary NOT operator. It returns every document in the database that is not in the set satisfying the expression. 6. valid_expression := word_token collocation_operator word_token Collocation operators are permitted only between words, not expressions. Each of the word tokens and the collocation operator itself occupy slots in the table of 8 maximum word tokens. Boolean Associativity and Precedence Table In order from highest precedence to lowest: Associativity Operator Example (none) COLLOC right NOT "aaa~bbb" resolved as "aaa & (~(bbb)" left AND "aaa bbb ccc" resolved as "(aaa & bbb) & ccc" left OR "aaa|bbb|ccc" resolved as "(aaa | bbb) | ccc" (none) naked word Example Boolean Queries aaa bbb ccc Returns all records that contain at least one occurrence of all three words. aaa | (bbb ~ccc) Retrieves all records containing "aaa" and also all records containing "bbb", but not "ccc". aaa ~(aaa @1 bbb) Returns all records containing "aaa" but omits those where "aaa" is one character away from "bbb". It is possible to formulate a query that requires retrieving all records in the database that contain none of the query words (for example, ~aaa. Users should be warned that in a large database such a search can take a very long time. Using the implied associativity and precedence rules, the ambiguous query string aaa ~bbb | ccc ~ddd @10 eee is disambiguated as (aaa & (~bbb)) | (ccc & (~(ddd @10 eee))). ARGUMENTS
search_type Specifies the type of search to perform. Valid values are P, W, and S. Search type P indicates that the query string is a sequence of words separated by ASCII whitespace. It requests that the words be stemmed prior to searching, that all documents containing any of the words be returned, that the results list be statistically sorted, and that no more than the top MaxResults list items be returned where MaxResults is the current value returned from DtSearchGetMaxResults. Note that a type P search is identical to a type S boolean search with an implied boolean OR between words. Search types W and S are boolean query searches. They indicate that the query string is a sequence of words and boolean operators matching the syntax described under "Types S and W Boolean Query Strings" above. Type S requests that words be stemmed prior to searching. Type 'W' requests that words be left unstemmed. Both types request that all documents containing the combinations of query words specified by the boolean operations be returned, that the results list be statistically sorted if possible, and that no more than the top MaxResults list items be returned whereMaxResults is the cur- rent value returned from DtSearchGetMaxResults. dbname Specifies which database is to be searched. It is any one of the database name strings returned from DtSearchInit or DtSearchReinit. If dbname is NULL, the first database name string is used. Within the specified database, searches will be restricted to those documents whose DtSrKeytype.is_selected field is nonzero. date1 and date2" 10 Specify a range of document dates to use for the search. Only documents within the specified range will be returned on the results list. date1 is the older end of the range and if not NULL, requests DtSearch to return only those records younger than (that is, after) the specified date. date2 is the younger end of the range and if not NULL, requests DtSearch to return only those records older than (that is before) the specified date. It is valid to specify just one of the arguments. Undated documents always qualify for a results list regardless of search date strings. The format of a valid date string is described in DtSearchValidDateString(3). stems and stemscount" 10 Specify a character buffer to hold parsed and stemmed words and a variable to receive the number of stored words. stems and stemscount are optional; they can be NULL. However, if either is specified, they must both be specified. If specified stemsmust point to a character buffer large enough to hold DtSrMAX_STEMCOUNT by DtSrMAXWIDTH_HWORD bytes. An array of parsed and stemmed query words will be stored here by the API for use by a later call to DtSearchHighlight. The size of the array will be stored in stemscount. results and resultscount" 10 Specify where a pointer to the results list will be stored and a variable to receive the number of items on the list. Results lists can be manipulated with several utility functions. In DtSearch, frequency of occurrence information is maintained for words across the whole database and within documents. For most queries, results lists are sorted by this statistical information and presented to the user as a "proximity" number for each doc- ument on the list. Proximity is meant to appear to a user as a distance, or a measure of the nearness of the query to the docu- ment. Conceptually, the smaller the proximity the "closer" the document is to the query and the more likely it will be valuable to the user DtSearch searches only one database at a time and returns only results lists for that single database. However, browsers often provide the illusion of simultaneous searches in multiple databases, merging the results lists by proximity when completed. Since the domain of knowledge and density of words and records may vary from database to database, the value of proximity numbers may similarly vary, and some databases may be underrepresented on merged results lists. RETURN VALUE
This function has three common return codes. DtSrOK is returned, as well as a results list and stems array, when the search was completely successful. DtSrNOTAVAIL is returned when the query was valid but the search was unsuccessful (that is, no set of documents matched the query). There are usually no messages with DtSrNOTAVAIL. DtSrFAIL is returned when the search was unsuccessful, usually because of an invalid query, and user messages on the MessageList explain why. Any API function can also return DtSrREINIT and the return codes for fatal engine errors at any time. SEE ALSO
DtSrAPI(3), DtSearchReinit(3), DtSearchGetMaxResults(3), DtSearchSetMaxResults(3), DtSearchGetKeytypes(3), DtSearchValidDateString(3), DtSearchSortResults(3), DtSearchFreeResults(3), DtSearchHighlight(3) DtSearchQuery(library call)
All times are GMT -4. The time now is 10:19 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy