Shell Programming and Scripting

Hi,

I have requirment to parse the file based on the follwing conditions and write the O/P to other file (which is '|' seperated) based on the following conditions.The records in the file are delimiter by space and the number of spaces also not fixed.

The structure of the O/P file is as below:

DateTime|Action|Device IP|Interface_Name|Source IP|Destination IP|Protocal|Service|Product|Reject|UserName

The logic for the O/P is:

1.General:
1.1 Select only those records where a record contains drop or reject.
1.2. Remove the empty line between the rows in the file
2. DateTime: pick date from 1st field and time from 2nd field and change the format to DD/MM/YYYY 24HH:MM:SS.
3. Action: 3nd field in the row
4. Device IP : 4rd filed in the row
5. Interface_Name : 5th field in the row after removing '<' or '>', but if we get the "daemon" in that field then we need to pick 5th and 6th fileds.
6. Source IP: pick the value which is present between _src:_ and ;
7. Destination IP : Pick the value which is present between _dst:_ and ;
8. Protocal : Pick the value which is present between _proto:_ and ;
9. Service : Pick the value which is present between _service:_ and ;
10.Product : Pick the value which is present between _product:_ and ;
11.Reject : Pick the value which is present between _reject_category:_ and ;
12.UserName : Pick the value which is present between _user:_ and ;
Note: _ denotes the space in the file

Example,

Input Records:

Code:

17Nov2010 14:51:37 ctl    10.44.48.103 >daemon sys_message: started logging net_rep_fw; product: VPN-1 & FireWall-1;
 
17Nov2010 14:37:30 drop   10.44.48.65 >eth-s1p1c0 TCP packet out of state: First packet isn't SYN; tcp_flags: RST-ACK; SmartDefense profile: No Protection; src: 172.30.86.4; dst: 195.43.131.13; proto: tcp; product: VPN-1 & FireWall-1; service: 80; s_port: 62594;
 
17Nov2010 14:27:34 accept 10.44.48.65 >eth-s1p1c0 rule: 3; rule_uid: {559499E5-1676-48FE-87E2-9D3128AF679F}; SmartDefense profile: No Protection; service_id: domain-udp; src: 172.30.86.1; dst: 194.72.9.38; proto: udp; xlatesrc: 10.44.48.65; NAT_rulenum: 1; NAT_addtnl_rulenum: 0; product: VPN-1 & FireWall-1; service: 53; s_port: 53497; xlatesport: 12741;
 
17Nov2010 15:30:00 reject 10.44.48.65 <daemon alert src: 10.44.48.112; dst: 10.44.48.65; user: remote3; reason: Client Encryption: Unknown user; scheme: IKE; reject_category: SecureClient authentication failure; fw_subproduct: VPN-1; vpn_feature_name: SecureClients; product: VPN-1 & FireWall-1;

Output Records:

Code:

17/11/2010 14:37:30|drop|10.44.48.65|eth-s1p1c0|172.30.86.1|195.43.131.13|tcp|80|VPN-1 & FireWall-1||
17/11/2010 15:30:00|reject|10.44.48.65|daemon alert|10.44.48.112|10.44.48.65|||SecureClient authentication failure|remote3

Regards,
MKS

Hi Frans,

I am not able execute the script

Many Thanks,
MKS

@OP: What have you tried so far?