topic Re: My awking buddies. in Operating System - Linux

My awking buddies.

Belinda Dermody — Thu, 10 Nov 2005 14:33:50 GMT

I am trying to use the current MM DD variable with a awk command within a script, extracting current days sudo usage, each entry is two lines.

I get the following to work but the date is hard coded.
awk '/Nov 10/ {print $0; for (i=1;i<2;i++) {getline;print $0; } }' /var/log/sudo.log

I want to set the date for each run with the CDATE=`date "+%b %d"` and beable to use the $CDATE instead of Nov 10 as above.

Re: My awking buddies.

Geoff Wild — Thu, 10 Nov 2005 14:44:27 GMT

Try:

awk '/'"$CDATE"'/ {print $0; for (i=1;i<2;i++) {getline;print $0; } }' /var/log/sudo.log

Rgds...Geoff

Re: My awking buddies.

Rick Garland — Thu, 10 Nov 2005 14:55:37 GMT

Here is a script that I wrote a few years ago. I believe it is doing what you want.
Modify for your use and preferences.

Note; Later versions of the sudo.log have a different layout of the file. The result is that this script will pull values that are no longer in this position.

Re: My awking buddies.

Belinda Dermody — Thu, 10 Nov 2005 15:10:43 GMT

Geoff I have already tried that, the preceeding ' nullifies all the special characters so the $ is not translated..

Re: My awking buddies.

James R. Ferguson — Thu, 10 Nov 2005 15:16:56 GMT

James:

One way:

# CDATE1=`date +%b`
# CDATE2=`date +%d`
# awk $1~CDATE1 && $2~CDATE2 {print $0;for (i=1;i<2;i++) {getline;print $0;}}' CDATE1=${CDATE1} CDATE2=${CDATE2} /var/log/sudo.log

You will need to change $1 and $2 to match the actual field numbers in you record.

Regards!

...JRF...

Re: My awking buddies.

Belinda Dermody — Thu, 10 Nov 2005 15:39:00 GMT

Jim, good to hear from you again, I get the good ole bail out in awk using your suggestion. See the attached word doc...

Re: My awking buddies.

James R. Ferguson — Thu, 10 Nov 2005 15:43:02 GMT

Hi (again) James:

Sorry, looks like I transposed a "'". Try:

# awk '$1~CDATE1 && $2~CDATE2 {print $0; for (i=1;i<2;i++) {getline;print $0;}}' CDATE1=${CDATE1} CDATE2=${CDATE2} /var/log/sudo.log

Regards!

...JRF...

Re: My awking buddies.

Sandman! — Thu, 10 Nov 2005 15:47:59 GMT

How about...

# CDATE=`date "+%b %d"`

# awk '$0 ~ cdt {print $0;for(i=1;i<2;i++) {getline;print $0}}' cdt="$CDATE" /var/log/sudo.log

cheers!

Re: My awking buddies.

Belinda Dermody — Thu, 10 Nov 2005 16:03:30 GMT

Still getting bailouts

Re: My awking buddies.

James R. Ferguson — Thu, 10 Nov 2005 16:16:38 GMT

Hi James:

My second post seems to work in my hands if I cut-and-paste from this site. Are you still getting syntax errors? No points if "yes" and/or at your discretion.

Regards!

...JRF...

Re: My awking buddies.

Geoff Wild — Thu, 10 Nov 2005 16:23:35 GMT

What about adding the carrot ^:

Try:

awk '/^'"$CDATE"'/ {print $0; for (i=1;i<2;i++) {getline;print $0; } }' /var/log/sudo.log

Rgds...Geoff

Re: My awking buddies.

Belinda Dermody — Thu, 10 Nov 2005 16:24:44 GMT

Jim, you are right, I maintain HP and Sun systems, it works ok from the command line on the HP system but I get bail out on the Sun system runnning Solaris 10. My HP sudo logs are one liners so I have no problem with those sysems, it is the new Sun systems that were dropped in my lap..

Re: My awking buddies.

Belinda Dermody — Thu, 10 Nov 2005 16:31:36 GMT

Ok Jim, if I use nawk on the Solaris system with your help I get the results, as always guys I knew you would be it to death and come up with the correct answer...

Re: My awking buddies.

James R. Ferguson — Thu, 10 Nov 2005 16:32:30 GMT

Hi James:

OK. There is another syntax to pass external variable. It uses '-v'. Try this:

# awk -v CDATE1=${CDATE1} -v CDATE2=${CDATE2} '$1~CDATE1 && $2~CDATE2 {print $0; for (i=1;i<2;i++) {getline;print $0;}}' /var/log/sudo.log

Regards!

...JRF...

Re: My awking buddies.

Belinda Dermody — Thu, 10 Nov 2005 16:38:50 GMT

Boy, I just read my closure, need a editor to verify what I wrote. Meant to say with all your help beating it to death we came up with the correct answer. I am not trying anything else, I have a stress headache already and if it works don't change it...