Solaris

Help...please.

I have a log that contains

Warning Authentication Failed: User GHDT88998HS doesn't exit: The User GHDT88998HS could not be found Mar 22, 2008 5:22:22AM com.hometel.ttm.auth.userlogin.

about maybe a thousand entries failed user acct message

How can I grab just the username and output to a new file?

Desired output should be

GHDT88998HS
GHDT778S7TT
GHDT55468FF
GHDT23206CC
GHDT99088OO
GHDT17290NN
GHDT99896RR
GHDT26790YY


thank you,
Riven

Assuming the lines in the file are exactly as shown in your post this should do it:

Code:

awk '{print $5 > "output_file"}' file

You might need to use nawk or /usr/xpg4/bin/awk on Solaris.


Hope it helps

Didn't notice it was a log file, so the presence of other lines not related to failed loggins. The following code should filter out the desired output:

Code:

awk '/Warning Authentication Failed/{print $5 > "output_file"}' file

It would have been easier if you posted a sample of the log file content.