Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Parsing syslog from Linux
Top Forums Shell Programming and Scripting Parsing syslog from Linux Post 303037246 by arm on Saturday 27th of July 2019 05:59:32 AM
Old 07-27-2019
can you add dstcountry to the Begin action , keep in mind that the required field could be "United State" or "Germany" or "South Africa" , here the tab is not working with awk , it only show me "United

Quote:
Originally Posted by RudiC
Try
Code:
awk '
BEGIN   {HDLN = "eventtime|srcip|dstip|srcport|dstport|transip|transport|action|sessionid"
         MX = split (HDLN, HD, "|")
         print HDLN
        }
        {DL = ""
         for (i=1; i<=MX; i++)  if (match ($0, HD[i] "=[^ ]*")) {L = length(HD[i]) + 1
                                                                 printf "%s%s", DL, substr ($0, RSTART + L, RLENGTH - L)
                                                                 DL = "|"
                                                                }
         printf "\n" 
        }
' file
eventtime|srcip|dstip|srcport|dstport|transip|transport|action|sessionid
1563205189|11.3.3.17|12.0.1.1|50544|443|11.1.1.1|5092|"server-rst"|20639817


EDIT: If you can't make sure all the requested fieds exist in the file, remove the if construct:
Code:
awk '
BEGIN   {HDLN = "eventtime|srcip|dstip|srcport|dstport|transip|transport|action|sessionid"
         MX = split (HDLN, HD, "|")
         print HDLN
        }
        {DL = ""
         for (i=1; i<=MX; i++)  {match ($0, HD[i] "=[^ ]*")
                                 L = length(HD[i]) + 1
                                 printf "%s%s", DL, substr ($0, RSTART + L, RLENGTH - L)
                                 DL = "|"
                                }
         printf "\n" 
        }
' file
eventtime|srcip|dstip|srcport|dstport|transip|transport|action|sessionid
1563205189|11.3.3.17|12.0.1.1|50544|443|11.1.1.1|5092|"server-rst"|20639817
1563205189|11.3.3.17|12.0.1.1||443|11.1.1.1|5092|"server-rst"|20639817
||||||||

In the second data line, the srcport is missing, and the third is empty entirely.
 

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Need some help with parsing

I have a big xml file with little formatting in it. It contains over 600 messages that I need to break each message out in its own separate file. The xml file looks in the middle of it something like this: </Title></Msg><Msg><Opener> Hello how are you?<Title> Some says hello</Title><Body>... (3 Replies)
Discussion started by: quixoticking11
3 Replies

2. Shell Programming and Scripting

Perl parsing compared to Ksh parsing

#! /usr/local/bin/perl -w $ip = "$ARGV"; $rw = "$ARGV"; $snmpg = "/usr/local/bin/snmpbulkget -v2c -Cn1 -Cn2 -Os -c $rw"; $snmpw = "/usr/local/bin/snmpwalk -Os -c $rw"; $syst=`$snmpg $ip system sysName sysObjectID`; sysDescr.0 = STRING: Cisco Internetwork Operating System Software... (1 Reply)
Discussion started by: popeye
1 Replies

3. Shell Programming and Scripting

Parsing of file for Report Generation (String parsing and splitting)

Hey guys, I have this file generated by me... i want to create some HTML output from it. The problem is that i am really confused about how do I go about reading the file. The file is in the following format: TID1 Name1 ATime=xx AResult=yyy AExpected=yyy BTime=xx BResult=yyy... (8 Replies)
Discussion started by: umar.shaikh
8 Replies

4. Red Hat

Parsing a linux file and formatting it.

Hi, I have a linux file that has data like this.. REQUEST_ID|text^Ctext^Ctext^C REQUEST_ID|text^Ctext^C REQUEST_ID| REQUEST_ID| REQUEST_ID|text^Ctext^Ctext^Ctext^Ctext^Ctext^C.... Where ever I see a ^C character, I need to copy the corresponding REQUEST_ID and that part of the text to a new... (17 Replies)
Discussion started by: charithainfadev
17 Replies

5. Shell Programming and Scripting

Parsing kiwi syslog from Astaro

Hello, I am trying to parse this syslog pulling out and logging results to a file. The information I want is: scrip, scrport, dstip, dstport. I just want the numbers, not including the text part ie srcip=". Problem is, the column locations change, so I can't use the nice awk $1 $2 etc to... (4 Replies)
Discussion started by: rmelnik
4 Replies

6. UNIX for Dummies Questions & Answers

Parsing linux commands through FTP

Hi Techies, I have made a shell script which stores the output of it in a text file. then i wanted to fetch that text file using windows scheduler in my windows xp desktop which i did successfully using the below mentioned ftp .bat file : @echo off @echo ftp_user>ftp_test.scr @echo... (0 Replies)
Discussion started by: gemnian.g
0 Replies

7. Shell Programming and Scripting

Help - Parsing data in XML in Linux

Hi, I have an XML file in Linux and it contains a long string of characters. The last part of the file is like ....... ....... ....... CAD</MarketDescription></InvestorTransaction></AdvisorAccount></DivisionAdvisor></Division>... (3 Replies)
Discussion started by: naveed
3 Replies

8. Shell Programming and Scripting

Specific string parsing in Linux/UNIX

Hi, I have a string which can be completely unstructred. I am looking to parse out values within that String. Here is an example <Random Strings> String1=<some number a> String2=<some number b> String3=<some number c> Satish=<some number d> String4=<some number e> I only want to parse out... (1 Reply)
Discussion started by: satishrao
1 Replies

9. SuSE

Location and name of SYSLOG in SUSE Linux

Esteemed listers, Where is the location of SYSLOG file? In etc/auditd.conf script, the log_file location is '/var/log/audit/audit.log' as below. Is this the location where SYSLOG is stored? Thank you in advance, log_file = /var/log/audit/audit.log log_format = RAW... (3 Replies)
Discussion started by: JDBA
3 Replies

10. Programming

Openlog and syslog in red-hat Linux doesn't write any thing to /var/log/*

Using redhat 64 bit ver 6.2 I have simple c++ app that is trying to write to syslog like this: /* try to write massage into linux log */ void foo::writeToSyslog() { openlog("testlogfoo", 0, 24); // Send the message. ... (1 Reply)
Discussion started by: umen
1 Replies

LEARN ABOUT SUSE

ocf_heartbeat_syslog-ng

OCF_HEARTBEAT_SYSLOG(7) 					OCF resource agents					   OCF_HEARTBEAT_SYSLOG(7)

NAME

       ocf_heartbeat_syslog-ng - Syslog-ng resource agent

SYNOPSIS

       syslog-ng [start | stop | status | monitor | meta-data | validate-all]

DESCRIPTION

       This script manages a syslog-ng instance as an HA resource.

SUPPORTED PARAMETERS

       configfile
	   This parameter specifies a configuration file for a syslog-ng instance managed by this RA. (required, string, no default)

       syslog_ng_binary
	   This parameter specifies syslog-ng's executable file. (optional, string, default /sbin/syslog-ng)

       start_opts
	   This parameter specifies startup options for a syslog-ng instance managed by this RA. When no value is given, no startup options is
	   used. Don't use option '-F'. It causes a stuck of a start action. (optional, string, no default)

       kill_term_timeout
	   On a stop action, a normal stop method(pkill -TERM) is firstly used. And then the confirmation of its completion is waited for the
	   specified seconds by this parameter. The default value is 10. (optional, integer, default 10)

SUPPORTED ACTIONS

       This resource agent supports the following actions (operations):

       start
	   Starts the resource. Suggested minimum timeout: 60s.

       stop
	   Stops the resource. Suggested minimum timeout: 120s.

       status
	   Performs a status check. Suggested minimum timeout: 60s.

       monitor
	   Performs a detailed status check. Suggested minimum timeout: 60s. Suggested interval: 60s.

       meta-data
	   Retrieves resource agent metadata (internal use only). Suggested minimum timeout: 5s.

       validate-all
	   Performs a validation of the resource configuration. Suggested minimum timeout: 5.

EXAMPLE

       The following is an example configuration for a syslog-ng resource using the crm(8) shell:

	   primitive example_syslog-ng ocf:heartbeat:syslog-ng 
	     params 
	       configfile=string 
	     op monitor depth="0" timeout="60s" interval="60s"

SEE ALSO

       http://www.linux-ha.org/wiki/syslog-ng_(resource_agent)

AUTHOR

       Linux-HA contributors (see the resource agent source for information about individual authors)

resource-agents 1.0.3						    07/05/2010						   OCF_HEARTBEAT_SYSLOG(7)
All times are GMT -4. The time now is 03:31 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy