Shell Programming and Scripting

Hi,

I'm trying to find pattern in log file. I'm using awk to search the pattern and print the paragraph. And it's not working well like I want.
The file actually is TCAP message, it has format like this :

...
...
...

*****************************************
INCOMING TCAP MESSAGE
At Thu May 22 14:41:26 2008
*****************************************
DEST ADDR: ni=0,ri=xx,pc=0xxx ssn=xx gt={noa=4,trans=0,plan=1,enc=2,addr=blabaalba}

ORIG ADDR: ni=0,ri=GT,ssn=xx gt={noa=4,trans=0,plan=1,enc=2,addr=blabab}

Received TR-BEGIN:
{
TRANSACTION PORTION:
origTransID=0x9106db37-91 06 db 37
******* INVOKE *******
Cs1InitialDP
serviceKey=XXX
callingPartyNumber=(4)NUMBER
callingPartysCategory=0xa
locationNumber=(4)number
highLayerCompatability=0x0,0x4,0x1,0x1
bearerCapability=0x0,0x0,0x0,0x10,0x3
eventTypeBCSM=2
iMSI(CAP)=XXXXX
vlrNumber(CAP)=Extension:1 NoA:1 Plan: 1 Digits:XXXX
cellIdFixedLength(CAP)=MCC:XX MNC:XX LAC:0XXX CellId:0xXXX
callReferenceNumber(CAP)=40 1c 41 34 0e 84 a6
mscAddress(CAP)=Extension:1 NoA:1 Plan: 1 Digits:XXXXX
calledPartyBCDNumber(CAP)=(0)XXXXX
**********************
}

...
...

I take Calling Party number as a pattern, and what I want is : search this full paragraph from Calling Party Number.
I use this code

Code:

awk '{RS="" } /NUMBER/' filename

but, I only get from "Received TR-BEGIN:" until "}"
How to get it full paragraph ? since it index position is unknown

Thanks

Code:

awk 'BEGIN{RS="" } /NUMBER/' filename

Isn't it the full paragraph containing 'NUMBER'?
What's your definition of 'paragraph'?
What's the desired output based on the sample input you've given?

hei, thanks for the response!
hm..my mistake not to describe it clearly

I have log file, for example, it's contains :

...
...

*****************************************
INCOMING TCAP MESSAGE
At Thu May 22 14:41:26 2008
*****************************************
DEST ADDR: ni=0,ri=PC,pc=0x51f ssn=146 gt={noa=4,trans=0,plan=1,enc=2,addr=0999999999}

ORIG ADDR: ni=0,ri=GT,ssn=146 gt={noa=4,trans=0,plan=1,enc=2,addr=0999999999}

Received TR-BEGIN:
{
TRANSACTION PORTION:
origTransID=0x9106db37-91 06 db 37
******* INVOKE *******
Cs1InitialDP
serviceKey=500
callingPartyNumber=(4)0899999002030
callingPartysCategory=0xa
locationNumber=(4)099999999
highLayerCompatability=0x0,0x4,0x1,0x1
bearerCapability=0x0,0x0,0x0,0x10,0x3
eventTypeBCSM=2
iMSI(CAP)=60890900250721
vlrNumber(CAP)=Extension:1 NoA:1 Plan: 1 Digits:099999999
cellIdFixedLength(CAP)=MCC:60 MNC:89 LAC:0x2710 CellId:0x795e
callReferenceNumber(CAP)=40 1c 41 34 0e 84 a6
mscAddress(CAP)=Extension:1 NoA:1 Plan: 1 Digits:099999999
calledPartyBCDNumber(CAP)=(0)08139534595494
**********************
}

*****************************************
OUTGOING TCAP MESSAGE
At Thu May 22 14:46:41 2008
*****************************************
DEST ADDR: ni=0,ri=PC,pc=0x51f ssn=146 gt={noa=4,trans=0,plan=1,enc=2,addr=0999999999}

ORIG ADDR: ni=0,ri=GT,ssn=146 gt={noa=4,trans=0,plan=1,enc=2,addr=0999999999}

Received TR-CONTINUE:
{
TRANSACTION PORTION:
origTransID=0x9106db37-91 06 db 37
destTransID=0xbb1d-00 00 bb 1d
******* INVOKE *******
Cs1ApplyChargingReport
reportData=a0 0b a0 03 81 01 01 a1 04 80 02 0b b8
CAP{
receivingSideID=1
timeIfNoTariffSwitch=3000
callActive=TRUE (default)
}
**********************
}

*****************************************
INCOMING TCAP MESSAGE
At Thu May 22 14:41:26 2008
*****************************************
DEST ADDR: ni=0,ri=PC,pc=0x51f ssn=146 gt={noa=4,trans=0,plan=1,enc=2,addr=0999999999}

ORIG ADDR: ni=0,ri=GT,ssn=146 gt={noa=4,trans=0,plan=1,enc=2,addr=0999999999}

Received TR-BEGIN:
{
TRANSACTION PORTION:
origTransID=0x9106db37-91 06 db 37
******* INVOKE *******
Cs1InitialDP
serviceKey=400
callingPartyNumber=(4)08999987059
callingPartysCategory=0xa
locationNumber=(4)0999999999
highLayerCompatability=0x0,0x4,0x1,0x1
bearerCapability=0x0,0x0,0x0,0x10,0x3
eventTypeBCSM=2
iMSI(CAP)=60890900250721
vlrNumber(CAP)=Extension:1 NoA:1 Plan: 1 Digits:0999999999
cellIdFixedLength(CAP)=MCC:60 MNC:89 LAC:0x2710 CellId:0x795e
callReferenceNumber(CAP)=40 1c 41 34 0e 84 a6
mscAddress(CAP)=Extension:1 NoA:1 Plan: 1 Digits:0999999999
calledPartyBCDNumber(CAP)=(0)0813131313131
**********************
}

*****************************************
OUTGOING TCAP MESSAGE
At Thu May 22 14:46:41 2008
*****************************************
DEST ADDR: ni=0,ri=PC,pc=0x51f ssn=146 gt={noa=4,trans=0,plan=1,enc=2,addr=0999999999}

ORIG ADDR: ni=0,ri=PC,pc=0xf1 ssn=146
Received TR-ABORT:
{
TRANSACTION PORTION:
destTransID=0xbb1d-00 00 bb 1d
pAbortCause=1
}

...
...
the message repeated again "INCOMING , OUTGOING ,..." for different callingPartyNumber. And for this file, I just want to take callingPartyNumber=(4)08999987059 's INCOMING TCAP MESSAGE.

so I use that code :

Code:

awk 'BEGIN  {RS=""} /08999987059/' filenamelog.txt

As I mention before, I only get the message from "Received TR-BEGIN:" until "}".
Is there any way to get itu full ( all message in red color) ?

Thanks

I just find out this code, and it can get previous line before pattern.

Code:

awk 'BEGIN {RS=""} /08999987059/ {print x ; print};{x=$0}' filenamelog.txt

but, I need to improve it more..
can someone help me ?

Thanks.

You will never learn how to use these tools unless you try to figure things out for yourself! KISS

Code:

grep -B15 -A13 08999987059 data.file

Hi,

if you only want to take callingPartyNumber=(4)08999987059 's INCOMING TCAP MESSAGE

try
awk '/MESSAGE/; /callingPartyNumber/' filename.log
but need to modify it

if you want to get full message from INCOMING TCAP MESSAGE until calledPartyBSCNumber please try

awk '/INCOMING TCAP MESSAGE/,/calledPartyBCDNumber/' filename.log

perhaps like that

thanks

Hi Adhit,

Thanks, but I already use that one, and it's not working like the way I want.

And danmero,

My Solaris doesn't support that grep option.

Thanks anyway.