Search query


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Search query
# 1  
Old 06-07-2013
Search query

Hi,

I have a typical requirement to find users having at least three occurrence in a log within an hour, and perform some action for that user. We have several steps, however I am kind of stuck here to accomplish the said requirement.

Here are the logs :

Code:
[04/Jun/2013:13:06:13 -0600] conn=13570 op=14 msgId=13 - BIND dn="uid=xyz123,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 tag=101 nentries=48030 etime=139 SRCH=Q

Basically, we need to find any user ( ie uid=xyz123), getting "SRCH=Q" in a particular connection have more than three occurrence within an hour. If you see the logs, they are related with "conn=13570".

In brief, here is the logic :

- Get the "SRCH=Q" occurence.
- Get the associated conn #, go back and get the bind user.
- Carrying bind user, search for "SRCH=Q" occurrence, if > 3, run add group command.

Let me know if we can get this via grep, sed or awk.


Thanks, JPrince

---------- Post updated 06-07-13 at 12:24 AM ---------- Previous update was 06-06-13 at 02:17 PM ----------

Hello,

Any reply on this?

JPrince

Last edited by johnprince1980; 06-06-2013 at 04:34 PM..
# 2  
Old 06-07-2013
Not sure how this is connected.
Give a lot more of input data, and example on output.
# 3  
Old 06-07-2013
Hi Jotne,

Thanks for reply.

If you see the below logs, how can i search for "SRCH=Q", and then get the string in the same row "conn=13570", and perform another search to get "uid=xyz123" by looking up "conn=13570" and BIND String ( as mentioned in the first row).

I want to do this activity until I get three searches, and then store the user in a list.

Hope this makes this clear.

Code:
[04/Jun/2013:13:06:13 -0600] conn=13570 op=14 msgId=13 - BIND dn="uid=xyz123,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 tag=101 nentries=48030 etime=139 SRCH=Q

# 4  
Old 06-07-2013
Not sure how well this work:
cat file
Code:
[04/Jun/2013:15:06:13 -0600] conn=13572 op=14 msgId=15 - RESULT err=0 tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:13:06:13 -0600] conn=13570 op=14 msgId=13 - BIND dn="uid=xyz123,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:13:06:13 -0600] conn=13572 op=14 msgId=13 - BIND dn="uid=xyz456,ou=People,o=xyz.com" method=128 version=3

Code:
awk 'FNR==NR {if ($0~"BIND") {split($8,s,"=|,");a[$3]=s[3]};if ($0~"SRCH=Q") b[$3]=$12;next} END { for (i in b) print b[i],i,a[i]}' file file
SRCH=Q conn=13570 xyz123
SRCH=Q conn=13572 xyz456

# 5  
Old 06-07-2013
Thanks for the code.

The intent here is to get the output only when there are 3 or more occurrences of search. When I run the code, it gives me an output even there are one occurrence.

Any reason why it is so?
# 6  
Old 06-07-2013
Code is made to display all hits

You need to select data for one hour and count.
Here is an example on how to get one hour count of data
Code:
data_1h=$(awk '$0>=from && $0<=to' from="$(date +"[%d/%b/%Y:%H:%M:%S" -d -1hour)" to="$(date +"[%d/%b/%Y:%H:%M:%S")" file)

To get this automatically and tell only 3 hits between one hour is possible, but that is up to you to create.
# 7  
Old 06-07-2013
Where should i restrict the hits in the code?
Login or Register to Ask a Question

Previous Thread | Next Thread

8 More Discussions You Might Find Interesting

1. Programming

MYSQL query search between dates

Just a little help if possible I have a table with date data, I want to select dates that fall between today and 1 month ago, here's my query SELECT id, stdate, DATE_SUB(CURDATE(), INTERVAL 1 month) as monthago, CURDATE() as today FROM data_table where (stdate between 'today' and 'monthago')... (4 Replies)
Discussion started by: barrydocks
4 Replies

2. Shell Programming and Scripting

Complex string search query.

Hi, I wish to find the latest occurance of the below string in my log file. Once found, I need to search the below string after the above string and display this Request 331489 has passed or Request 331489 has failed I would like my query to be platform... (11 Replies)
Discussion started by: mohtashims
11 Replies

3. Shell Programming and Scripting

Query the table and return values to shell script and search result values from another files.

Hi, I need a shell script, which would search the result values from another files. 1)execute " select column1 from table_name" query on the table. 2)Based on the result, need to be grep from .wft files. could please explain about this.Below is the way i am using. #!/bin/sh... (4 Replies)
Discussion started by: Rami Reddy
4 Replies

4. Shell Programming and Scripting

Ldap search query

Hi All, I have a existing Ldap query which take a HOME as variable and gives the result where i grep for a particular line. ldapsearch -h server_domain_name -p 389 -D "uid=user,ou=appadm,o=ent" -w PaB -b "ou=roles,o=ent" "cidx=$HOME" | grep -w "ent: xyz" Now i have 330K Homes in a... (1 Reply)
Discussion started by: posner
1 Replies

5. UNIX for Dummies Questions & Answers

Search Query

This issue has been causing me a headache all night.... I have a file, from a third party payment vendor, that contains an export of data including an order number (unique) and a payment value, amongst other data. I need to use the order numbers to integrate the database to check the order... (2 Replies)
Discussion started by: theref
2 Replies

6. Shell Programming and Scripting

Query Oracle tables and return values to shell script that calls the query

Hi, I have a requirement as below which needs to be done viz UNIX shell script (1) I have to connect to an Oracle database (2) Exexute "SELECT field_status from table 1" query on one of the tables. (3) Based on the result that I get from point (2), I have to update another table in the... (6 Replies)
Discussion started by: balaeswari
6 Replies

7. UNIX for Dummies Questions & Answers

LDAP search query help

I would like to do an ldap search which looks for entries which do not actually have a certain attribute. Not that the attribute is Null, but where the attribute does not exist. Is this possible using ldapsearch? (3 Replies)
Discussion started by: dopple
3 Replies

8. UNIX for Dummies Questions & Answers

query on how to search for a line and read 4th word from that line

Assume I have a text file as below: me con pi ind ken pras ur me con rome ind kent pras urs pintu con mys ind pan pras ki con kit ind sys My requirement, I need to search for "con rome" and if exists, then print 4th word from rome, i.e in above example, since "con rome"... (4 Replies)
Discussion started by: jaggesh
4 Replies
Login or Register to Ask a Question