UNIX for Dummies Questions & Answers

Hello,

I have a series of logs that I need to analyse.
each looks something like:

234.10.72.175 Mon Mar 02 20:25:00 GMT 2009
226.91.87.86 Thu Mar 05 03:50:26 GMT 2009
226.91.87.86 Thu Mar 05 04:06:07 GMT 2009

Using awk, so far I have been able to count the lines in a specific file that match a patter. For example, those in Mar, 2009, between 10:00:00 and 12:00:00. But a combination of the text month and numeric year have me stumped.

an example of the lines I have been using

Code:

# between two times
awk -v "sTIME=${STARTTIME}" -v "eTIME=${ENDTIME}" '{if ($5 >= sTIME && $5 <= eTIME) print $1 }' home.hits 

#day begins with S, so a weekend
awk '$2 ~ /^S/' test.hits 

# doesnt match above...
awk '$2 !~ /^S/' test.hits

I am now having trouble with the date as they are in the mmm format.

I have thought about using sed to change the months format.
using an array and piping the output of awk into another to check.

change the times to epoch


I am currently not sure what the best way to do this is.
Cheers for looking

What is your ultimate goal? You are doing a report, it seems, so how do you want to group the final results? ie., group ip address by month, for workday activity?

For example:

Code:

awk ' /(Mon|Tue|Wed|Thu|Fri)/  { arr[$1 " " $3]++ }
        END (for i in arr) { print i, arr[i] } ' logfile  | sort

Cheers for the reply Jim,

I would like to be able to apply two patterns to the files.
So that I am able to get the records that are from Feb 2009 to Mar 2010 for example.

Code:

awk '
       /Apr/ && /2010/ {ok=0}
       /Feb/ && /2009/ {ok=1}
      ok { your awk code to format and group the data goes here }
      {next}  ' logfile > report

The {next} is needed if you are using an ancient version of awk.

This awk syntax is:

Code:

    boolean { function }

where boolean evaluates to true or false. By default undeclared values like ok - are zero.
This turns on processing for the first occurrence on Feb && 2009. turns it off for the first occurrence of Apr 2010 - ie. just past Mar 2010

Jim,
sorry for my delayed reply.
I dont understand where you have used ok.

are you able to explain it further?
many thanks

After running this, but with Apr+ 2006 and Feb+2009
I only got results from Feb and Mar 2009