Shell Programming and Scripting

Yesteray I post a topic talking about log processing, thanks aigles for giving me the script, the first time I heard "next" and "gsub" function, so I decided to do some test work, but I failed, and don't know why

The logfile as follow, notice line 2 contains an username

*snip*
Nov 9 10:12:01 testfirewall root: [ID 702911 local5.info] 0:00:11 accept testfw01-hme0 >hme0 proto: icmp;
src: test001.example.net; dst: abc.dst.net; rule: 1; icmp-type: 8; icmp-code: 0; product: VPN-1 & Fire

Nov 9 10:12:54 testfirewall root: [ID 702911 local5.info] 0:23:54 accept testfw01-hme0 >hme0 proto: tcp; src: maa.example.net; dst: NYCMNYZRHN0.dst.net; service: cerent_1080; s_port: 1649; rule: 30; user: abc; len: 44; srcname: abc.example.net; product: VPN-1 & FireWall-1
*snip*

the request

"find16 column doesn't contain 192.1 or 192.2 or deve"

AND

"there is "user" keyword appears in the log"

AND

delete all the ";" character in the log

my though was like this

gawk 'BEGIN {OFS = "\t"} $16!~"192.(1|2)|deve" && $0~"user" {next} gsub(/;/,"") {print $0}' fw.log

But the script work incorrectly, and I noticed when I just use the first part of the awk program,

gawk 'BEGIN {OFS = "\t"} $16!~"192.(1|2)|deve" && $0~"user"' fw.log

there was no problem, every line match the criterion I defined, but when I add

" {next} gsub(/;/,"") " seemed awk process the logfile totally different, the output result even did not contain "user", I tried to delete "next", still same.

I tried comp.awk.faq, but no information related to "next" function.

So please give me some direction what's wrong with my script? and what exactly "next" do in awk. Thank you!

A next statement causes the next input record to be read and pattern testing to restart with the first pattern {action} pair in the program.

The next statement in your awk program excludes all the lines thet you want to select.

Code:

awk '
       # Initialisation : set Output Field Separator to tabulation.
       BEGIN {
          OFS = "\t";  
       }
       # Select lines not containing "user" with field16 not  
       # containing 192.1 or 192.2 or "deve"
       $16!~/192.(1|2)|deve/ && $0~/user/ {
          gsub(/;/, "");     # Deletes all ";" in the current record
          print $0;          # Print current record
       }
    ' fw.log

Jean-Pierre.

when you say 'next input record', do that mean next input line?

I am sorry, I do not get you on this, could you give me a simple example?

Pardon me if this is a stupid question.

Yes in the normal case. If you have not modified the variable RS in your awk program, its default value is new line and hence a new record would mean "next line"

John Arackal