nawk syntax difficulty

[uksnowman]

Hi people,

I am parsing a log file, removing blank lines and certain lines which have useless information. I can do all these things separately, but not when I put them together in one script! Please can someone suggest the correct syntax so the whole log file is pared correctly. Prog below:-

When the script runs, it reads the log file, the while loop works fine and deletes backspace chars, but blank lines and lines with text in field $2 are not deleted for some reason.
I have also tried to remove non-alpha chars from field $4 at the end of the script, this does not work correctly in the script, but the command works fine separately.

Example log file:-

111.222.333.444 555.666.777.888 21/tcp <unknown>
&quot;starting up&quot;
111.222.333.444 555.666.777.888 21/tcp &quot;guest&quot;

Output file:-

DESTINATION SOURCE PORT USERNAME
111.222.333.444 555.666.777.888 21/tcp unknown
111.222.333.444 555.666.777.888 21/tcp guest

Prog:-

#! /bin/nawk -f

BEGIN {
printf &quot;\n%15s\t%15s\t%10s\t%10s\n\n&quot;, &quot;DESTINATION&quot;, &quot;SOURCE&quot;, &quot;PORT&quot;, &quot;USERNAME&quot;
}

{
if ( $0 ~ /^$/ ) {} # Do not print blank lines
elseif ( $2 !~ /[A-Za-z]/) # Ignore any lines with text in field 2
{
while ( $4 ~ /\^H/ || $4 ~ /\?/ )
{
gsub ( /\&quot;/,&quot;&quot; )
if ( $4 ~ /^\^H/ )
sub ( /\^H/, &quot;&quot; )
sub ( /.\^H/, &quot;&quot; )
sub ( /\^\?/, &quot;&quot; )
$4 = &quot;\&quot;&quot;$4&quot;\&quot;&quot;
}
++num
}
}
{
printf &quot;%15s\t%15s\t%10s\t%10s\n&quot;, $2, $5, $3
gsub( /[^A-Za-z0-9<> \t]/, &quot;&quot; ); # Remove all non-alpha chars from username field $4
printf &quot;%10s\n&quot;, $4
}

END {
print NR, &quot;sessions read.&quot;
print num, &quot;Modifications made.&quot;
}

Thanks in advance,
uksnowman

 

[Krunek]

Hi, uksnowman!

Try put this block
 
{
    printf &quot;%15s\t%15s\t%10s\t%10s\n&quot;, $2, $5, $3
    gsub( /[^A-Za-z0-9<> \t]/, &quot;&quot; ); # Remove all non-alpha chars from username field $4
    printf &quot;%10s\n&quot;, $4
}

inside first block of main loop.

You can also use this pattern

NF <> 4 || $2 !~ /[a-zA-Z]/ { actions }

and your awk program can be simpler.

I didn't test this solutions, but I hope this helps.

Bye!

KP.

 

[flogrr]

#! /bin/nawk -f

BEGIN {
printf &quot;\n%15s\t%15s\t%10s\t%10s\n\n&quot;, &quot;DESTINATION&quot;, &quot;SOURCE&quot;, &quot;PORT&quot;, &quot;USERNAME&quot;
}

/^$/ {next} # Do not print blank lines
$2 ~ /[A-Za-z]/ {next} # Ignore any lines with text in field 2

{
while ( $4 ~ /\^H/ || $4 ~ /\?/ )

{
gsub ( /\&quot;/,&quot;&quot; )
if ( $4 ~ /^\^H/ ) sub ( /\^H/, &quot;&quot; )
sub ( /.\^H/, &quot;&quot; )
sub ( /\^\?/, &quot;&quot; )
}
gsub( /[^A-Za-z]/,&quot;&quot;,$4 ) # Remove non-alpha chars
$4 = &quot;\&quot;&quot;$4&quot;\&quot;&quot;
++num
}
{
printf &quot;%15s\t%15s\t%10s\t%10s\n&quot;, $2, $5, $3, $4
}

END {
print NR, &quot;sessions read.&quot;
print num, &quot;Modifications made.&quot;
}



flogrr
flogr@yahoo.com