if , then else I am confused

[kd4pba]

I am trying to write a simple script that does the following on my Linux Box.


I want to obtain data from the following.

ps -ef |grep in.telnetd
which returns

root 16089 993 0 08:53 ? 00:00:00 in.telnetd: 12.146.161.76
chris 16131 16092 0 08:54 pts/3 00:00:00 grep in.telnetd

Now, I know I can pipe the output to awk and grab the fields I want , which are the process ID (field 2) and the IP address ( field 9)

So, that would be ps -ef |grep in.telnetd |awk '{print $2, $9)'

Here is my issue,

First I want dropp the second line from grep ( maybe I should not be using grep) Since it returns information I don't need. In other words I Only want the fields from Line 1 not line 2.

Now on to the if, then , else part....


I want to first out put this data to a file, then, if the data in $2 is the same the next time around I dont want to output it to the file again until it changes.

What I am trying to do is create an alert that will notify me of telnet attempts and print them on the screen as they happen.

 

[Krunek]

Hi kd4pba!

Yo can omit grep step in your command line statement and use directly awk to filter output of ps command and print 2. and 9. column:

ps -ef | awk '/in.telnetd/ { next }  {print $2, $9 }'

Bye!

KP.

 

[vgersh99]

It's actually like that - you wanna "get" in.telnetd - NOT filter it out:

ps -ef | awk '/in.telnetd/ {print $2, $9 }'

The rest of the logic [consecutive invocations and comparing] is left as the exercise to the user

Write it to a file and read it in in the "BEGIN" block of the awk script. Compare what you get in the body of the awk script WITH what's been stored in the file previously [an read in the BEGIN block].

 

[kd4pba]

Thanks that more like what I am looking for.

This actually IS a great exercise, I am still learning, but maybe by the time I finish my book, I will have this down and if I am lucky I will know something about awk.

I think some of the "logic" is in chapter's 5 and 6.

thanks

Chris

 

[Krunek]

Oops,

mistake!

Sorry, kd4pba! Thanks, vgersh99!

Bye!

KP.