Shell Programming and Scripting

Sep 28 17:16:37 samplehostname sshd[32092]: subsystem request for sftp
Sep 28 18:21:30 samplehostname sshd[23278]: pam_unix(sshd:session): session closed for user oracle
Sep 28 19:27:31 samplehostname sshd[30298]: pam_unix(sshd:session): session closed for user oracle
Sep 28 19:39:57 samplehostname sshd[21016]: pam_unix(sshd:session): session closed for user oracle
Sep 28 19:39:57 samplehostname su: pam_unix(su:session): session closed for user root
Sep 28 19:39:57 samplehostname su: pam_unix(su:session): session closed for user root
Sep 28 19:58:41 samplehostname sshd[32092]: pam_unix(sshd:session): session closed for user root
Sep 29 11:05:59 samplehostname sshd[4368]: Accepted password for oracle from 10.99.22.123 port 61494 ssh2
Sep 29 11:05:59 samplehostname sshd[4368]: pam_unix(sshd:session): session opened for user oracle by (uid=0)
Sep 29 11:09:59 samplehostname su: pam_unix(su:session): session opened for user root by oracle(uid=501)
Sep 29 12:24:36 samplehostname sshd[6855]: Failed password for oracle from 10.225.124.234 port 54622 ssh2
Sep 29 12:24:36 samplehostname sshd[6855]: Failed password for oracle from 10.225.124.234 port 54622 ssh2

awk '
        BEGIN {
                printf "%-15s\t%-15s\%-15s\t%-15s\n", "HOST", "USER", "FROM", "TIME"
        }
        /Accepted password/ {
                printf "%-15s\t%-15s\%-15s\t%-15s\n", $4, $9, $11, $1 FS $2 FS $3
        }
' OFS='\t' rsyslog_file

awk '
        BEGIN {
                printf "%-15s\t%-15s\t%-15s\t%-15s\n", "HOST", "USER", "FROM", "TIME"
        }
        /(Accepted|Failed) password/ {
                printf "%-15s\t%-15s\t%-15s\t%-15s\n", $4, $9, $11, $1 FS $2 FS $3
        }
' OFS='\t' rsyslog_file

awk '
        BEGIN {
                printf "%-15s\t%-15s\t%-15s\t%-15s\t%-15s\n", "HOST", "USER", "FROM", "TIME", "STATUS"
        }
        /(Accepted|Failed) password/ {
                printf "%-15s\t%-15s\t%-15s\t%-15s\t%-15s\n", $4, $9, $11, $1 FS $2 FS $3, $6
        }
' OFS='\t' rsyslog_file