Shell Programming and Scripting

Or just a shorter pipe chain in bash. using egrep lets you match more complicated expressions, and using the -o option tells it to print only the matching part.

Code:

zegrep -o "DHCPDISCOVER xid=0x[a-z0-9]+" < logfile.gz | sort | uniq -c

---------- Post updated at 06:28 PM ---------- Previous update was at 06:21 PM ----------

Are you trying to match data to some existing format? Why store a lack of data?

Hi Corona,

This is how the DHCP messages look like in the logs

Nov 4 06:47:22 dhcp01 ZEMdhcp: 01/0010E7218F82: Got DHCPDISCOVER xid=0x2158b2c1 from 0.0.0.0 via 10.140.2.10, req-ip=None, 82=None.

I have some MAC addresses that I need to monitor - how many discovers they send per day. The MAC addresses look like this : 0010E7218F82.
The output of the following script is :

cat /var/log/messages.2.gz | zgrep 94.18 | grep "DHCPDIS" | grep 0010E7218F82 | cut -c7- | cut -d ' ' -f5 | sort | uniq -c

582 0010E7218F82

That's the count of the DHCP discovers sent by this MAC.
I have a list of MACs that I need to monitor, that's why I need to put 0 for the MACs that do not issue any discover. Then copy-paste the results into an excel.

So how can i adapt the script above to have the output like :

0 0010E7218F82

if it does not find anything ?

Liviu

---------- Post updated at 11:00 AM ---------- Previous update was at 10:54 AM ----------


This works! Thanks a lot!

---------- Post updated at 11:28 AM ---------- Previous update was at 11:00 AM ----------

Thanks Chuber,

How can I set this code for a pattern ?

Lets say that I have a list of MACs like this

0012CFCDA11A
0012CFCDA123
0012CFCD7123

..and I want to apply the code for each MAC addreses in the list ?

What do you mean "apply the code"? Do you mean "check if it's in the list"?

Two ways:

Easy but not so efficient:

Code:

for MYmac in 0012CFCDA11A 0012CFCDA123 0012CFCD7123
do
    zcat /var/log/messages.2.gz | awk -v MAC=$MYmac -v C=0 '{ if ($0 ~ "DHCPDIS.*94.18.*"MAC ) C++ } END { print C, MAC }'
done

Efficient but more complex, is to put your Mac-list into the file "macs" and process file and stdin with awk:

Code:

zcat messages.gz | awk '{ F+=(FNR==1);
       if (F==1) cnt[$1]=0;
       if (F==2 && $0 ~ "DHCPDIS.*94.18") {
            MAC=gensub(/^.*ZEMdhcp: ([^:]*):.*/, "\\1", "");
            if (MAC in cnt) cnt[MAC]++;
       } } END { for(i in cnt) print cnt[i], i } ' macs -