patten matching on a string that contains spaces

[mrberry]

I am trying to search the messages file for all the occurances that happen at a particular date and time.

Below is the 4 lines from the messages file that I am interested in (2 occurances of the problem)

----------------------------------------------------------------------------------------------------------------
Feb 18 21:03:07 backup SCSI transport failed: reason 'tran_err': giving up
Feb 18 21:03:07 backup root: [ID 702911 daemon.notice] NetWorker media: (notice) 8mm AIT-3 tape dbpool1:001 on /dev/rmt/11cbn is full
Feb 18 23:10:13 backup SCSI transport failed: reason 'tran_err': giving up
Feb 18 23:10:13 backup root: [ID 702911 daemon.notice] NetWorker media: (notice) 8mm AIT-3 tape sunfire6800:075 on /dev/rmt/9cbn is full
---------------------------------------------------------------------------------------------------------------

I want to search for the string "tran_err", get the date and time - first 3 fields (eg Feb 18 21:03:07) and then search back in the messages file for the string "full" that occurred at the same time as the "tran_err".


I have been playing with grep, awk and cut (I don't know Perl), but either end up with

1) each string on a separate line:

Feb
18
21:03:07
Feb
18
23:10:13

2) everything on the same line:

Feb 18 21:03:07 Feb 18 23:10:13


when it goes back to search in the messages file.

Any help is appreciated.

 

[PHV]

A starting point:
awk '
/full/ && a==$1 && b=$2 && c=$3
/tran_err/{a=$1;b=$2;c=$3}
' /path/to/input

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[mrberry]

PHV, thanks for your help. The code that you gave me had a syntax error when I tried to run it, but playing with what you gave me I was able to get what I wanted:

awk ' 
      /tran_err/ {a=$1;b=$2;c=$3}; 
      /is full/ && $1==a && $2==b && $3==c 
      {print a,b,c " tran_err on device "$17} 
      ' /var/adm/messages