Shell Programming and Scripting

Hello all,

first off great forum.

Now for my little problem.

Using RHEL 5.4 and awk. Been doing code since a few month. So just starting.

My problem is handeling data on multiple lines.

Code:

{
if ($1 != LASTKEY && h["canonicalName"] ~ /.*\/s_fr_[a-z]/)  {
        checkgecos( h["unixname"], h["gecos"] ) 
        h[unixname]=""
        h[gecos]=""
}
if ($2 == "gecos" || $2 == "unixname" || $2 == "canonicalName") {
        h[$2] = $3
}
LASTKEY = $1
}

This code handles great the following data:

toto1:unixname:toto1
toto1:uid:4567
toto1:gecos:Toto Toto
toto1:canonicalName:us.bla.bla.bla
bob2:unixname:bob2
bob2:uid:7676
....

But i can't figure out how to handle this kind of data spread on multiple lines (ex: sudo.log file)

Mar 9 17:24:28 : toto : TTY=pts/2 ; PWD=/home/toto ; USER=root
; COMMAND=/bin/cat /var/log/sudo.log

Of course to add more problem... It can be spread on more then 2 lines...

Jan 29 12:10:50 : toto : TTY=unknown ; PWD=/home/toto ; USER=root ;
COMMAND=/bin/nice find / /export /boot blablabla -mount
-type f -name catalina.jar -o -name license.bea -o -name weblogic.jar -o
-name httpd -o -name config.nice

Tried with a while and getline to get second line but that didn't seem to do the trick.

What are you guy's tricks for handleling multiple line data?

I'd suggest changing the RS and/or FS built-in variables of awk, then you can input text with all newlines replaced, something like this:

Code:

cat file_with_multi_lines | tr '\n' ' ' | awk '
BEGIN{RS=""; FS="__FS__";} 
{
  $0=gensub(/[[:upper:]][[:lower:]][[:lower:]] [0-9][0-9]? [0-9][0-9]:[0-9][0-9]:[0-9][0-9]/, "__FS__", "g", $0);  
  for(i=2; i<=NF; i++) {
     print "NEWFIELD: " $i;}
}'

That looks kinda clumsy, I have to admit... let me explain: here I first replace all newlines with spaces (tr) , then pipe to awk, which will handle it all as one record; the big regex will capture date and replace it with __FS__; and then you have your data in the fields...
Instead of 'tr' you could hack the RS built-in, and replace the newlines within awk code...

Not quite elegant, but should work.

Works great!

I modified it a little bit cause some lines where not being handle correctly but now it works like a charm.

I will remember this trick!

Thanks!!