print a particular line

[Valarie Lim]

Hi,

I have a log file to log ftp connection. A successful ftp connection will be something like this:

connection from ::ffff:123.2.3.4
FTP LOGIN from 123.2.3.4, user1

You will not see the sentence FTP LOGIN if the ftp login is incorrect.

How do I check from the log file to check those incorrect ftp login?

[Bharat Katkar]

HI
does this helps?

# cat logfile | grep -v "FTP LOGIN"
Regards,

[Yogeeraj_1]

hi,

you can also do a:

grep -i "ftp login" /path/filename

if you want to check the last occurrance you may as well pipe it to "tail -1"

hope this helps too!

regards
Yogeeraj

[Valarie Lim]

using grep -v "FTP LOGIN"
will still show other tranactions such as file transfer, logging out.

If there is a way to check for "connection from" and if the next line is not "FTP LOGIN from", then the chance of unsuccessful login is high.

[Muthukumar_5]

We can do your requirement as,

# cat testfile
connection from ::ffff:123.2.3.4
FTP LOGIN from 123.2.3.4, user1
connection from ::ffff:123.2.3.4
FTP from 123.2.3.4, user1
connection from ::ffff:123.2.3.4
FTP LOGIN from 123.2.3.4, user1
connection from ::ffff:123.2.3.4
FTP from 123.2.3.4, user1


# awk '/connection/ { IP=$3; getline; if ( $1 == "FTP" && $2 == "LOGIN" ) print IP " FTP connection OK" }' testfile
::ffff:123.2.3.4 FTP connection OK
::ffff:123.2.3.4 FTP connection OK


It will give you successful IP-Address there by checking connection keyword and FTP LOGIN there.

HTH.

[Bharat Katkar]

Hi,

# cat logfile | grep -E 'FTP FAILED | connection from'

This should work.
I don't know exaclty what is the message of failed FTP login but you can use the same in grep command with E option as shown above.
Hope that helps.
Regards,

[Bharat Katkar]

Sorry ..it won't work..just forget it

[Valarie Lim]

To rephrase my enquiry, I want to check an incorrect ftp login and print out the line.

What I observe in the log, an unsuccessful login will not show message such as "FTP FAILED", "Error login FTP",etc. It will just show there is connection from an ip.

E.g. 3 unsuccessful login from 123.2.3.4/7/9 will be shown as :

connection from ::ffff:123.2.3.4
connection from ::ffff:123.2.3.7
connection from ::ffff:123.2.3.9

[Muthukumar_5 · Accepted solution]

We can go exact script and output file as,

if pattern connection from found and it's next lines pattern is not that FTP LOGIN from then, we have to prompt error.

Take from my prev. reply example,

So try as,
# awk '/^connection from/ { line=$0 } { getline; if ( $1 != "FTP" || $2 != "LOGIN" || $3 != "from" ) print line" "$0" Failed" }' testfile
connection from ::ffff:123.2.3.4 FTP from 123.2.3.4, user1 Failed
connection from ::ffff:123.2.3.4 FTP from 123.2.3.4, user1 Failed

To do more accurate then,

# awk '/^connection from/ { line=$0 } { getline; if ( $1 == "FTP" && $2 == "LOGIN" && $3 == "from" ) print line" "$0" SUCCESS"; else print line" "$0" FAILED" }' testfile
connection from ::ffff:123.2.3.4 FTP LOGIN from 123.2.3.4, user1 SUCCESS
connection from ::ffff:123.2.3.4 FTP from 123.2.3.4, user1 FAILED
connection from ::ffff:123.2.3.4 FTP LOGIN from 123.2.3.4, user1 SUCCESS
connection from ::ffff:123.2.3.4 FTP from 123.2.3.4, user1 FAILED


It will give SUCCESS / FAILED informations there.

HTH.

[Valarie Lim]

Thanks everyone for your effort, especially to Muthukumar.

I do some modification to Muthukumar's solution and derived :

# cat testfile
connection from ::ffff:123.2.3.4
FTP LOGIN from 123.2.3.4, user1
connection from ::ffff:123.2.3.4
FTP from 123.2.3.4, user1
connection from ::ffff:123.2.3.4
FTP LOGIN from 123.2.3.4, user1
connection from ::ffff:123.2.3.4
FTP from 123.2.3.4, user1
connection from ::ffff:123.2.3.12
connection from ::ffff:123.2.3.44
connection from ::ffff:123.2.3.12
connection from ::ffff:123.2.3.4
FTP from 123.2.3.4, user1



#awk '/connection/ { IP=$3; getline; if ( $0 !~ /.FTP.*/) print IP " FTP connection incorrect" }' testfile
::ffff:123.2.3.12 FTP connection incorrect
::ffff:123.2.3.44 FTP connection incorrect
::ffff:123.2.3.12 FTP connection incorrect