topic Re: script error in Operating System - HP-UX

script error

himacs — Sat, 13 Jun 2009 19:24:40 GMT

Hi Admins,

I have a script used for obtain details of logins from syslog.i have assigned data1=Jun and
data2=9.
i can obtain jun 9 login details.But if i change data2=10 ,no output shown.i think this is due to double didgit(10).

please help me on this

regards
himacs

Re: script error

Patrick Wallek — Sat, 13 Jun 2009 19:34:03 GMT

It might help if we could see the script and what output you are getting and what output you expect to get.

Re: script error

himacs — Sat, 13 Jun 2009 19:36:45 GMT

Hi patrik,

Thanx for the reply..

#!/bin/sh
#date1=`date|awk '{print $2}'`
#date2=`date|awk '{print $3}'`
date1=Jun
date2=8
hostname=`hostname`
echo "___________________________________________________________________"

echo " $hostname - System Login Details "
echo "___________________________________________________________________"

echo "DATE TIME ID FROM IP "
echo "___________________________________________________________________"
grep -i sshd syslog.log|grep -i keyboard-interactive |grep "$date1 $date2" |awk
'{print $1" "$2" "$3" "$9" "$11}'

the script gives details of logins on that day.

regards
himacs

Re: script error

James R. Ferguson — Sat, 13 Jun 2009 21:08:37 GMT

Hi:

Your problem arises when you do:

grep "$date1 $date2"

The dates in 'syslog.log' are in the format of a three-character month name followed by one space followed by a right-justified, space-filled day.

If you run your code with 'date2=1' you will match (errneously) any day in the month that is a 2-digit day where the first digit is one (1)!

One way to fix this is to declare 'date2' thusly:

# typeset -R2 date2=1

The use of 'typeset' is documented in the 'sh-posix' manpages.

Regards!

...JRF...

Re: script error

Dennis Handly — Sun, 14 Jun 2009 02:00:30 GMT

>grep "$date1 $date2"

This can be fixed by regexp:
grep "$date1 *$date2"

>JRF: three-character month name followed by one space followed by a right-justified, space-filled day.

This is just broken. They should be fixed fields and zero filled.
I know there are some locales that have space filled and other more evil ones that aren't even fixed widths. But syslog should follow American nerd and be easy to parse.

Re: script error

Peter Nikitka — Sun, 14 Jun 2009 18:41:15 GMT

Hi,

besides the fact, that the multiple 'grep' pipeline could be done completely in awk, I would at least subsitute the last part in adressing Dennis' remark from
>>
... |grep "$date1 $date2" |awk
'{print $1" "$2" "$3" "$9" "$11}'
<<
to (assuming month-> field 1 ($1); day-> field 2 ($2) )

... | awk -v mon=$data1 -v day=$data2 '$1 == mon && $2 == day {print $1" "$2" "$3" "$9" "$11}'

awk will accept any amount of whitespace here when determining fields.

mfG Peter