Extra question for "Removing trailing <blanks>"

[kimmers]

This thread pretty much answered for the question I had in mind while browsing these columns and vgersh99 nawk answer worked for me the best, to get rid of the trailing blanks or spaces.

So I would like to add an extra question:

I have an a error.log file where error messages from the message system queue are written into the same line.
So only one long line in a error.log file containing multiple error messages.

Those error messages are separated by whitespaces or tabs etc. from each other.
So it is one big chunk of text and the log file is not fixed length. Therefore using $1, $2 won't work eventhough there might be common phrase which to grep.

What I would like to get out of that log file is the last error message and send it to my email, to see what is going on in a system if error occurs.

In n a script level, after removing the spaces from the end

a) is to take the last, lets say 150 characters from the the end of the file and put them into another variable

or

b) tougher, preferred one: Take the last message entirely not considering how long it is and put it in a variable

Example from the (imaginary) error.log
(sorry, couldn't attach here the original one)
------
ERROR occured in system (here lotsa spaces & tabs)
ANOTHER ERROR occurred (again lotsa spaces)
AGAIN something happened (spaces, tabs) <-File ends to spaces, tabs, what ever.

From the end these spaces etc. blanks can be eliminated with the vgersh99 nawk help.

ER=error.log

cat $ER| awk 'sub(/[ \t]*$/, "")' > /tmp/error.txt

So in the error.txt file it has removed from the end the white spaces and tabs, but how to get the last message:
AGAIN something happened
into variable MSG so that I could email it
MSG=$(cat /tmp/error.txt)
mailx -s "Error occured in a system" $MSG my.name@domain.com

and with awk this could be simplified w/o using temporary files, but I am not that familiar with it.

Something like this
awk 'sub(/[ \t]*$/, "")' $ER (works)
MSG=$(awk 'sub(/[ \t]*$/, "")' $ER) (insert into variable doesn't work)

Plus addition to here to grep the last error message.
Here could be used previous message white spaces as a separator since in a actual error.log message file there are normally more than 4 spaces between messages, but single message could contain 2-3 spaces.
So to play safe 4 or more spaces could be used as a separator and the end of the file.
Is it the EOF in awk NF or what does that mean in awk syntax?

Regards,

#Kimmers -beginner awker =bawker? )

 

[feherke]

Hi

As I know, this will work with [tt]nawk[/tt] too. ( Tested only with [tt]gawk[/tt] and [tt]mawk[/tt]. )

awk 'BEGIN{RS="[ \t][ \t]+"} END{print $0}' $ER | mail -s "Error occured" my.name@domain.com

Feherke.

http://rootshell.be/~feherke/

 

[kimmers]

Hi Feherke,

I tried it out, but looks like it didn't work for me, since it returned just an empty answer.

So, I have talked in my question about nawk but I have used awk, since some of AIX machines that I use, do not have nawk (nor gawk/mawk).
In this vgersh99 example was he replacing tabs with "" nothing?
Should this yours do the same?
Or is it actually doing so, I don't understand the syntax.
As a result, should this print the last message?

#Kimmers

 

[Annihilannic]

Kimmers,

feherke's solution probably treated the trailing spaces as a record separator, so the last record was blank.

Try this perhaps:

MSG=$(awk '
    BEGIN {RS="[ \t][ \t][ \t][ \t]+"} 
    $0 != "" {last=$0} 
    END {sub("[ \t]*$","",last);print last}
' $ER)

This version also makes sure that the record separator is more than 4 spaces or tabs.


Annihilannic.

 

[feherke]

Hi

Or is it actually doing so, I don't understand the syntax.

- set the [tt]RS[/tt] ( record separator ) to 2 or more consecutive spaces and/or tabs
- print the last record

feherke's solution probably treated the trailing spaces as a record separator, so the last record was blank.

[tt]gawk[/tt], [tt]mawk[/tt] and [tt]gawk --traditional[/tt] usually ignores trailing blanks, like this :

[blue]master #[/blue] echo "one   two   three   " | awk '{print NF,$NF}'
3 three

In my tests this happend at record level too, printing the desired string, "AGAIN something happened".

Kimmers wrote that (s)he has a regular [tt]awk[/tt], so the problem is with the regular expression as separator.

Feherke.

http://rootshell.be/~feherke/

 

[kimmers]

Hi there!

Now it works as I hoped,
Annihilannic, your addition brought the desired solution, thank you!

Feherke, I think you are right, that the normal awk is not treating similarly reqular expressions.
I do not have the other flavours installed, which might have worked -don't know.

Anyways, Thank Ya'll!

Now I can just take the last message and pipe it to cut to get i.e the first 150 characters of the message
cut -c 1-150

P.S. I am male,

Reg,

#Kimmers

 

[PHV]

Why piping to cut ?
In awk simply replace this:
print last
with this:
print substr(last,1,150)

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[kimmers]

Hi PHV,

Good point, I guess my excuse was that I don't know awk that much, but that example of yours was neat and useful!

Since we have torn this thread open and I was wondering in my orig. question a) how to read from the end of the file i.e last 150 characters after stripping the trailing ends does substr() work in reverse order?

I already got the solution what I was looking for, but this came to my mind, and it would come handy if you just want to take last x number of characters from the end, after you have parsed the last message from the error message queue.

Or just want to read certain number of chracters from the end of the file.

Reg,

#Kimmers

 

[PHV]

read certain number of chracters from the end of the file
NumOfChar=150
tail -c $NumOfChar /path/to/file

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[kimmers]

Thanks PHV,

That did the job!

Cheers,

#Kimmers