Script help - grep for string with embedded spaces

[Scott Lindstrom_2]

I need to grep auth.log for entries for the current date and hour. So I set a match string as such:

blank=" "
match_string="$(date "+%b") $blank $(date "+%e") $(date "+%H")"

(I am not sure yet if $blank is working; when I concatenate the three portions of the date fields I need a space between the month and day of the month).

Currently $match_string = "Dec 10 09", so this looks good so far.

I now want to grep auth.log for lines that match this string. But I cannot seem to get a command that looks at the entire match string as one field. I have tried:

#grep $match_string /var/adm/syslog/auth.log
grep: can't open 10
grep: can't open 09
This is followed by listing all "Dec" entries.

I have also tried:
grep "$match_string" /var/adm/syslog/auth.log
gives me no results at all.

What should be captured by the grep would (for example) be:
Dec 10 09:55:03 sshd[10843]: Accepted password...
Dec 10 09:55:03 su: + ...

Any help would be appreciated.

Scott Lindstrom

[Michael Schulte zur Sur · Accepted solution]

Hi,

use grep "$match_string" /var/adm/syslog/auth.log
otherwise your line is evaluates to:
grep Dec 10 09 /var/adm/syslog/auth.log
which is obviously wrong syntax.
greetings,

Michael

[Graham Cameron_1]

You have too many spaces in your string.

Try this:

match_string=$(date +"%b %e %H")
grep "$match_string" /var/adm/syslog/auth.log

-- Graham

[Scott Lindstrom_2]

Michael -

I had tried that and got no results.

But now that I look back, I had no entries for the hour in the match string!

I was so caught up in looking for a valid syntax, that I forgot to look for the obvious reason.

Scott

[Michael Schulte zur Sur]

Hi,

one should read all the email and not answer to quickly. ;-)
Try grep -i. Sometimes I get results with that. It should work, like you tried.
Is auth.log an ascii file?

greetings,

Michael

[Neil Dixon]

works if

blank="\ "
match_string="$(date "+%b")$blank$(date "+%e")$blank$(date "+%H")"

grep "$match_string" /var/adm/syslog/auth.log

[A. Clay Stephenson]

First you don't need ${blank} as the shell will concatenate the $(date)'s and spaces within the quoted string just fine. I would change the "+%X"'s to single quotes because we want them to remain absolutely intact.

match_string="$(date "+%b") $blank $(date "+%e") $(date "+%H")"

should be:
match_string="$(date '+%b') $(date '+%e') $(date '+%H')"
then
grep "${match_string}" filename should work just fine.

I would do this first so that you can see exactly what ${match_string is set to -- it's difficult to know if you have spaces or tabs just wiewing your posting because of the way HTML handles whitespace.

echo "Match_string = \"${match_string}\""

When you get the spaces to exactly match what is in your file then grep should work like a charm iff you double quote the expression to match so that the variable is expanded AND passed as one argument to grep.

[Scott Lindstrom_2]

Graham -

match_string=$(date +"%b %e %H") works great (given that today is day 10).

Clay -

The reason that the space seemed to be an issue is yesterday's auth.log entries look like:
Dec 9 15:15:04

Today's auth.log entries look like:
Dec 10 07:07:04

Even though I understand %e is supposed to return the day of the month with a leading space, when I tried it with the three fields concatenated, I was getting "Dec 9 15" instead of "Dec 9 15". I may have to find a system in which I can set the date back to try this some more today.

Scott

[Scott Lindstrom_2]

The posting I just did does not show that:

Dec 9 15:15:04

should have two spaces between Dec and 9.

Scott

[Scott Lindstrom_2]

Neil -

I tried:
blank="\ "
print $blank

and get back \ as the value of $blank.

Am I missing something here?

Scott

[Michael Schulte zur Sur]

Hi Scott,

are you still having trouble?

greetings,

Michael

[A. Clay Stephenson]

Okay, if date '%e' is behaving a little strangely then we need to use typeset to assign each component. I would first look for any patches for date and apply them. I don't like it when commands don't behave as advertised but I have seen it. This workaround will fix you:

e.g.
typeset -R2 MDAY=$(date '+%e')
match_string="$(date '+%b') ${MDAY} $(date '+%H')"

and will right justify to 2 positions and fill with leading spaces regardless if the day is a one or two digit value.

[Scott Lindstrom_2]

Michael -

Still working my way thru testing the various replies. Things are looking very good. (I think I may be all set, but not 100% sure).

These forums are great! Getting so many valuable replies that I am behind in trying them is a great situation to be in!

Scott