My awking buddies.

[Belinda Dermody]

I am trying to use the current MM DD variable with a awk command within a script, extracting current days sudo usage, each entry is two lines.

I get the following to work but the date is hard coded.
awk '/Nov 10/ {print $0; for (i=1;i<2;i++) {getline;print $0; } }' /var/log/sudo.log

I want to set the date for each run with the CDATE=`date "+%b %d"` and beable to use the $CDATE instead of Nov 10 as above.

[Geoff Wild]

Try:

awk '/'"$CDATE"'/ {print $0; for (i=1;i<2;i++) {getline;print $0; } }' /var/log/sudo.log


Rgds...Geoff

[Rick Garland · Accepted solution]

Here is a script that I wrote a few years ago. I believe it is doing what you want.
Modify for your use and preferences.

Note; Later versions of the sudo.log have a different layout of the file. The result is that this script will pull values that are no longer in this position.

[Belinda Dermody]

Geoff I have already tried that, the preceeding ' nullifies all the special characters so the $ is not translated..

[James R. Ferguson]

James:

One way:

# CDATE1=`date +%b`
# CDATE2=`date +%d`
# awk $1~CDATE1 && $2~CDATE2 {print $0;for (i=1;i<2;i++) {getline;print $0;}}' CDATE1=${CDATE1} CDATE2=${CDATE2} /var/log/sudo.log

You will need to change $1 and $2 to match the actual field numbers in you record.

Regards!

...JRF...

[Belinda Dermody]

Jim, good to hear from you again, I get the good ole bail out in awk using your suggestion. See the attached word doc...

[James R. Ferguson]

Hi (again) James:

Sorry, looks like I transposed a "'". Try:

# awk '$1~CDATE1 && $2~CDATE2 {print $0; for (i=1;i<2;i++) {getline;print $0;}}' CDATE1=${CDATE1} CDATE2=${CDATE2} /var/log/sudo.log

Regards!

...JRF...

[Sandman!]

How about...

# CDATE=`date "+%b %d"`

# awk '$0 ~ cdt {print $0;for(i=1;i<2;i++) {getline;print $0}}' cdt="$CDATE" /var/log/sudo.log

cheers!

[Belinda Dermody]

Still getting bailouts

[James R. Ferguson]

Hi James:

My second post seems to work in my hands if I cut-and-paste from this site. Are you still getting syntax errors? No points if "yes" and/or at your discretion.

Regards!

...JRF...

[Geoff Wild]

What about adding the carrot ^:

Try:

awk '/^'"$CDATE"'/ {print $0; for (i=1;i<2;i++) {getline;print $0; } }' /var/log/sudo.log


Rgds...Geoff

[Belinda Dermody]

Jim, you are right, I maintain HP and Sun systems, it works ok from the command line on the HP system but I get bail out on the Sun system runnning Solaris 10. My HP sudo logs are one liners so I have no problem with those sysems, it is the new Sun systems that were dropped in my lap..

[Belinda Dermody]

Ok Jim, if I use nawk on the Solaris system with your help I get the results, as always guys I knew you would be it to death and come up with the correct answer...

[James R. Ferguson]

Hi James:

OK. There is another syntax to pass external variable. It uses '-v'. Try this:

# awk -v CDATE1=${CDATE1} -v CDATE2=${CDATE2} '$1~CDATE1 && $2~CDATE2 {print $0; for (i=1;i<2;i++) {getline;print $0;}}' /var/log/sudo.log

Regards!

...JRF...

[Belinda Dermody]

Boy, I just read my closure, need a editor to verify what I wrote. Meant to say with all your help beating it to death we came up with the correct answer. I am not trying anything else, I have a stress headache already and if it works don't change it...