UNIX for Advanced & Expert Users

Hello Everyone

I need your help in fixing this issue., I have a log file which has data of users logging in to an application.

I want to search for a particular pattern in the log

Code:

ISSessionValidated=N

If this key word is found , the above 8 lines will contain the name of the user who's session did not validate

for example .. the log section would be some thing like this

Code:

12:34:45 CT Session 334d3dx3z322cx User : appleInc2232
transfering tag..
transfering session..
transfering data..
level one tag completed ..
file created...
logging into main application
user session transfer created..
ISSessionValidated=N
Exception caught.. Session invalidated ..
Exiting thread 334d3dx3z322cx

I need to search the log file which has multiple sessions like this and check if the session validated = N if the keyword is found then i should check the above 8 lines and see if the user is appleInc2232 if found a count should be incremented in a file. There are over 11k sessions like this in a single log file.But the pattern is like this.

Operating system : SOLARIS 10
Single Log file size above : 4 GB
Over 700 log files with the same data is availble ( if you give a start as to how to proceed it will be helpful )
log files pattern is something like this

Code:

binded.session.01_01_2011
binded.session.01_02_2011
binded.session.01_03_2011
binded.session.01_04_2011.gz
binded.session.01_05_2011.gz
binded.session.01_06_2011.gz
---- More ---

Any help would be greatly appreciated. Thanks.

You can start with this:

Code:

perl -0072 -ne '/appleInc2232.*ISSessionValidated=N/s && $i++;END{print "$i\n"}' logfile

Perl is not running in our machine can you please suggest a shell script ?

Try:

Code:

nawk '/appleInc2232.*ISSessionValidated=N/{i++}END{print i}' RS=":" logfile

nawk nawk...

Code:

[n]awk '{FS=/appleInc2232.*ISSessionValidated=N/}END{print NF-1}' file

Thanks both of you, it works,. i have one last question how can i make this work with compressed log files .gz files. ?

Code:

gzcat logfile.gz | nawk '/appleInc2232.*ISSessionValidated=N/{i++}END{print i}' RS=":"