Visit Our UNIX and Linux User Community


Need help with script.


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Need help with script.
# 1  
Old 09-02-2009
Bug Need help with script.

Hi:

I am using linux and trying to format logs. I have grepped for stuff like invalid users and /or error. However, the way the logs are formatted, sometimes the full error is not on the line, ie. it is on the next line. If I grep something, like:
cat /var/spool/mail/* |grep -i session |awk '{print $5}'
The information I want is in the log on the next line. Is there a way to get the following lines anyone can think of? Thanks so much for your help in advance.
Henry
# 2  
Old 09-02-2009
You could try
Code:
awk '/error/{_=2}_&&_--' /var/spool/mail/*

# 3  
Old 09-02-2009
Can you post a sample log file.
# 4  
Old 09-02-2009
this is a small snippet Dan.

Illegal users from:
192.168.42.22 (impala.snas-net): 1 time

**Unmatched Entries**
pam_succeed_if(sshd:auth): error retrieving information about user henry : 1 time(s)

If I cat for illegal, I don't find out where the 'illegal' is coming from because the actual ip is on the next line. Or the next line, where I grep for unmatched but don't get the user Henry.

I'm fairly new to scripting or not very knowledgeable at this time. Thanks.

---------- Post updated at 12:57 PM ---------- Previous update was at 12:50 PM ----------

Here is another sample of the log where I want to grab the second line following the line I grepped for.

sshd:
Authentication Failures:
unknown (impala.snas-net): 1 Time(s)
Invalid Users:
Unknown Account: 1 Time(s)
# 5  
Old 09-02-2009
I haven't been able to figure out how to insert a variable into the search field, or I'd provide that example... Here's something that will return the line that matches your search string AND the line that follows immediately afterward.

Code:
#!/bin/sh

/usr/xpg4/bin/awk '/Illegal users/{_=2}_&&_--' /var/spool/mail/*
/usr/xpg4/bin/awk '/Unmatched Entries/{_=2}_&&_--' /var/spool/mail/*
/usr/xpg4/bin/awk '/Authentication Failures/{_=2}_&&_--' /var/spool/mail/*
/usr/xpg4/bin/awk '/Invalid Users/{_=2}_&&_--' /var/spool/mail/*

You might pass the log file in as an argument - so that it's not always checking the /var/spool/mail directory.

edit ----------
that should be {_=1}

Last edited by avronius; 09-02-2009 at 04:31 PM..
# 6  
Old 09-02-2009
Two basic example
Code:
awk '/([Illegal|Invalid] [U|u]sers)|Authentication Failure|Unmatched Entries/{printf $0;getline;print FS $0}' file

Code:
egrep -A1 "([Illegal|Invalid] [U|u]sers)|Authentication Failure|Unmatched Entries" file

# 7  
Old 09-03-2009
I'm getting there and I really appreciate everyone's help. Thank you all.

I tried Av's and Dan's code and they both worked. The last thing I tried was dan's awk statement, which produced this after a bit of tweaking.

**Unmatched Entries** unix_chkpwd[8788]: password check failed for user (henry)
**Unmatched Entries** unix_chkpwd[13474]: password check failed for user (henry)
**Unmatched Entries** unix_chkpwd[13474]: password check failed for user (henry)
**Unmatched Entries** unix_chkpwd[22256]: password check failed for user (henry)
**Unmatched Entries** unix_chkpwd[8788]: password check failed for user (henry)
**Unmatched Entries** unix_chkpwd[13474]: password check failed for user (henry)
**Unmatched Entries** unix_chkpwd[13474]: password check failed for user (henry)
**Unmatched Entries** unix_chkpwd[22256]: password check failed for user (henry)

which is very good. It seems like its looking for unmatched entries, I'm sure there's an easy way of looking for other items (multiple items) such as A or B or C. In my case it would be unmatched entries or Illegal users from? Thanks again, this has been great for me, I am finally learning how to script. Smilie

---------- Post updated at 09:56 AM ---------- Previous update was at 09:55 AM ----------

I am sorry, can you please explain this further?

You might pass the log file in as an argument - so that it's not always checking the /var/spool/mail directory.

I don't know how to pass the log file in as an argument.

Thanks.

Quote:
Originally Posted by avronius
I haven't been able to figure out how to insert a variable into the search field, or I'd provide that example... Here's something that will return the line that matches your search string AND the line that follows immediately afterward.

Code:
#!/bin/sh

/usr/xpg4/bin/awk '/Illegal users/{_=2}_&&_--' /var/spool/mail/*
/usr/xpg4/bin/awk '/Unmatched Entries/{_=2}_&&_--' /var/spool/mail/*
/usr/xpg4/bin/awk '/Authentication Failures/{_=2}_&&_--' /var/spool/mail/*
/usr/xpg4/bin/awk '/Invalid Users/{_=2}_&&_--' /var/spool/mail/*

You might pass the log file in as an argument - so that it's not always checking the /var/spool/mail directory.

edit ----------
that should be {_=1}

Previous Thread | Next Thread
Test Your Knowledge in Computers #711
Difficulty: Easy
The earliest computing machines had fixed programs.
True or False?

5 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

How to block first bash script until second bash script script launches web server/site?

I'm new to utilities like socat and netcat and I'm not clear if they will do what I need. I have a "compileDeployStartWebServer.sh" script and a "StartBrowser.sh" script that are started by emacs/elisp at the same time in two different processes. I'm using Cygwin bash on Windows 10. My... (3 Replies)
Discussion started by: siegfried
3 Replies

2. Shell Programming and Scripting

Shell script works fine as a standalone script but not as part of a bigger script

Hello all, I am facing a weird issue while executing a code below - #!/bin/bash cd /wload/baot/home/baotasa0/sandboxes_finance/ext_ukba_bde/pset sh UKBA_publish.sh UKBA 28082015 3 if then echo "Param file conversion for all the areas are completed, please check in your home directory"... (2 Replies)
Discussion started by: ektubbe
2 Replies

3. UNIX for Dummies Questions & Answers

Calling a script from master script to get value from called script

I am trying to call a script(callingscript.sh) from a master script(masterscript.sh) to get string type value from calling script to master script. I have used scripts mentioned below. #masterscript.sh ./callingscript.sh echo $fileExist #callingscript.sh echo "The script is called"... (2 Replies)
Discussion started by: Raj Roy
2 Replies

4. Shell Programming and Scripting

Script will keep checking running status of another script and also restart called script at night

I am using blow script :-- #!/bin/bash FIND=$(ps -elf | grep "snmp_trap.sh" | grep -v grep) #check snmp_trap.sh is running or not if then # echo "process found" exit 0; else echo "process not found" exec /home/Ketan_r /snmp_trap.sh 2>&1 & disown -h ... (1 Reply)
Discussion started by: ketanraut
1 Replies

5. Shell Programming and Scripting

create a shell script that calls another script and and an awk script

Hi guys I have a shell script that executes sql statemets and sends the output to a file.the script takes in parameters executes sql and sends the result to an output file. #!/bin/sh echo " $2 $3 $4 $5 $6 $7 isql -w400 -U$2 -S$5 -P$3 << xxx use $4 go print"**Changes to the table... (0 Replies)
Discussion started by: magikminox
0 Replies

Featured Tech Videos