All,
I have a couple of really huge text files to parse. Radius output logs for five services per 24 hour span. I need to drop the "Start" records and keep the "Stop" records, so I can analyze values within the "Stop" records.
Here's what the data typically looks like:
<-SAR->
RADIUS-R05|[1013126401]|2002-02-08:00:00:01|(FRI)
User-Name = "USER"
NAS-Identifier = xxx.xxx.xxx.xxx
NAS-Port = 20301
NAS-Port-Type = Async
Acct-Status-Type = Start
Acct-Delay-Time = 0
Acct-Session-Id = "378074791"
Acct-Authentic = RADIUS
Framed-Protocol = PPP
Framed-Address = xxx.xxx.xxx.xxx
<-EAR->
<-SAR->
RADIUS-R20|[1013126402]|2002-02-08:00:00:02|(FRI)
NAS-Identifier = XXX.XXX.XXX.XXX
NAS-Port = 20202
NAS-Port-Type = Async
Acct-Status-Type = Stop
Acct-Delay-Time = 0
Acct-Session-Id = "352201385"
Ascend-Disconnect-Cause = 10
Ascend-Connect-Progress = 31
Ascend-Data-Rate = 0
Ascend-PreSession-Time = 65
Ascend-Pre-Input-Octets = 0
Ascend-Pre-Output-Octets = 0
Ascend-Pre-Input-Packets = 0
Ascend-Pre-Output-Packets = 0
Caller-Id = "XXXXXXXXXX"
Client-Port-DNIS = "XXXXXXX"
<-EAR->
My thought was to use Sed to drop out the EAR/SAR headers, input a newline between records and then ask Awk to select only those records with NF >= 14, which would seem to drop out the "Start" records, and leave the "Stop" ones.
I've had to change that slightly, since I can't seem to substitute or insert (or append) an newline character in Sed, but I have been able to drop out the EAR/SAR in favor of a "-", with the though that I can set FS = "/n" and RS to "^-".
At this point, I'm stumped. I have never been able to come up with a selection criteria that sent only the desired records out to a file. Any thoughts?
I have a couple of really huge text files to parse. Radius output logs for five services per 24 hour span. I need to drop the "Start" records and keep the "Stop" records, so I can analyze values within the "Stop" records.
Here's what the data typically looks like:
<-SAR->
RADIUS-R05|[1013126401]|2002-02-08:00:00:01|(FRI)
User-Name = "USER"
NAS-Identifier = xxx.xxx.xxx.xxx
NAS-Port = 20301
NAS-Port-Type = Async
Acct-Status-Type = Start
Acct-Delay-Time = 0
Acct-Session-Id = "378074791"
Acct-Authentic = RADIUS
Framed-Protocol = PPP
Framed-Address = xxx.xxx.xxx.xxx
<-EAR->
<-SAR->
RADIUS-R20|[1013126402]|2002-02-08:00:00:02|(FRI)
NAS-Identifier = XXX.XXX.XXX.XXX
NAS-Port = 20202
NAS-Port-Type = Async
Acct-Status-Type = Stop
Acct-Delay-Time = 0
Acct-Session-Id = "352201385"
Ascend-Disconnect-Cause = 10
Ascend-Connect-Progress = 31
Ascend-Data-Rate = 0
Ascend-PreSession-Time = 65
Ascend-Pre-Input-Octets = 0
Ascend-Pre-Output-Octets = 0
Ascend-Pre-Input-Packets = 0
Ascend-Pre-Output-Packets = 0
Caller-Id = "XXXXXXXXXX"
Client-Port-DNIS = "XXXXXXX"
<-EAR->
My thought was to use Sed to drop out the EAR/SAR headers, input a newline between records and then ask Awk to select only those records with NF >= 14, which would seem to drop out the "Start" records, and leave the "Stop" ones.
I've had to change that slightly, since I can't seem to substitute or insert (or append) an newline character in Sed, but I have been able to drop out the EAR/SAR in favor of a "-", with the though that I can set FS = "/n" and RS to "^-".
At this point, I'm stumped. I have never been able to come up with a selection criteria that sent only the desired records out to a file. Any thoughts?