script error

[himacs]

Hi Admins,

I have a script used for obtain details of logins from syslog.i have assigned data1=Jun and
data2=9.
i can obtain jun 9 login details.But if i change data2=10 ,no output shown.i think this is due to double didgit(10).

please help me on this


regards
himacs

[Patrick Wallek]

It might help if we could see the script and what output you are getting and what output you expect to get.

[himacs]

Hi patrik,

Thanx for the reply..

#!/bin/sh
#date1=`date|awk '{print $2}'`
#date2=`date|awk '{print $3}'`
date1=Jun
date2=8
hostname=`hostname`
echo "___________________________________________________________________"

echo " $hostname - System Login Details "
echo "___________________________________________________________________"

echo "DATE TIME ID FROM IP "
echo "___________________________________________________________________"
grep -i sshd syslog.log|grep -i keyboard-interactive |grep "$date1 $date2" |awk
'{print $1" "$2" "$3" "$9" "$11}'


the script gives details of logins on that day.

regards
himacs

[James R. Ferguson · Accepted solution]

Hi:

Your problem arises when you do:

grep "$date1 $date2"

The dates in 'syslog.log' are in the format of a three-character month name followed by one space followed by a right-justified, space-filled day.

If you run your code with 'date2=1' you will match (errneously) any day in the month that is a 2-digit day where the first digit is one (1)!

One way to fix this is to declare 'date2' thusly:

# typeset -R2 date2=1

The use of 'typeset' is documented in the 'sh-posix' manpages.

Regards!

...JRF...

[Dennis Handly]

>grep "$date1 $date2"

This can be fixed by regexp:
grep "$date1 *$date2"

>JRF: three-character month name followed by one space followed by a right-justified, space-filled day.

This is just broken. They should be fixed fields and zero filled.
I know there are some locales that have space filled and other more evil ones that aren't even fixed widths. But syslog should follow American nerd and be easy to parse.

[Peter Nikitka]

Hi,

besides the fact, that the multiple 'grep' pipeline could be done completely in awk, I would at least subsitute the last part in adressing Dennis' remark from
>>
... |grep "$date1 $date2" |awk
'{print $1" "$2" "$3" "$9" "$11}'
<<
to (assuming month-> field 1 ($1); day-> field 2 ($2) )

... | awk -v mon=$data1 -v day=$data2 '$1 == mon && $2 == day {print $1" "$2" "$3" "$9" "$11}'

awk will accept any amount of whitespace here when determining fields.

mfG Peter