awk or perl print feilds after regex.

casperdaghost · 01-26-2013, 07:10 AM

Is there a way in awk or perl to just print everything including and after the 'sh'
This text file had the ip and host names edited out. The filed are not all uniform - I can't use the stardard awk print out $1 $4 and $5 fields, because the information in each field is not consistent.

Code:

Jan 26 03:00:03  corectld: client casperhost:36121: exec: sh -c "ping -c 3 172.18.47.1"
Jan 26 03:00:20  corectld: client casperhost:45957: exec: sh -c ifconfig
Jan 26 03:00:20  corectld: client casperhost:46804: exec: sh -c "ethtool eth1"
Jan 26 03:00:33  ntpd[541]: kernel time sync status change 6001
Jan 26 03:17:36  ntpd[541]: kernel time sync status change 2001
Jan 26 03:51:45  ntpd[541]: kernel time sync status change 6001
Jan 26 04:00:05  corectld: client casperhost:53123: exec: sh -c "cat /proc/cpuinfo"
Jan 26 04:00:05  corectld: client casperhost:53176: exec: sh -c "dmidecode -t system"
Jan 26 04:00:07  corectld: client casperhost:53321: exec: sh -c "dmidecode -t bios"
Jan 26 04:00:18  corectld: client casperhost:58729: exec: sh -c uptime
Jan 26 04:00:19  corectld: client casperhost:58748: exec: sh -c "cat /proc/meminfo"
roc/sys/vm/min_free_kbytes" ectld: client casperhost:33485: exec: sh -c "cat /p--More-- (24% of 5110 bytes)
Jan 26 04:00:24  corectld: client casperhost:34644: exec: sh -c "uname -a"
Jan 26 04:00:26  corectld: client casperhost:35100: exec: sh -c "cat /proc/cmdline"
Jan 26 04:00:27  corectld: client casperhost:35154: exec: sh -c "ls /usr/java/"

druuna · 01-26-2013, 07:29 AM

Are you looking for something like this:

Code:

awk -F" sh" '/sh/{ print $2 }' infile
 -c "ping -c 3 172.18.47.1"
 -c ifconfig
 -c "ethtool eth1"
 -c "cat /proc/cpuinfo"
 -c "dmidecode -t system"
 -c "dmidecode -t bios"
 -c uptime
 -c "cat /proc/meminfo"
 -c "cat /p--More-- (24% of 5110 bytes)
 -c "uname -a"
 -c "cat /proc/cmdline"
 -c "ls /usr/java/"

And although not perl/awk, here's also a sed solution:

Code:

sed -n 's%.*exec: sh%%p' infile 
 -c "ping -c 3 172.18.47.1"
 -c ifconfig
 -c "ethtool eth1"
 -c "cat /proc/cpuinfo"
 -c "dmidecode -t system"
 -c "dmidecode -t bios"
 -c uptime
 -c "cat /proc/meminfo"
 -c "cat /p--More-- (24% of 5110 bytes)
 -c "uname -a"
 -c "cat /proc/cmdline"
 -c "ls /usr/java/"

druuna · 01-26-2013, 07:45 AM

Quote:

Originally Posted by casperdaghost

Is there a way in awk or perl to just print everything including and after the 'sh'

I might have misinterpreted that in my previous reply.

Easily fixed:

Code:

awk -F" sh" '/sh/{ print "sh"$2 }' infile 
sh -c "ping -c 3 172.18.47.1"
sh -c ifconfig
sh -c "ethtool eth1"
sh -c "cat /proc/cpuinfo"
sh -c "dmidecode -t system"
sh -c "dmidecode -t bios"
sh -c uptime
sh -c "cat /proc/meminfo"
sh -c "cat /p--More-- (24% of 5110 bytes)
sh -c "uname -a"
sh -c "cat /proc/cmdline"
sh -c "ls /usr/java/"

sed -n 's%.*exec: sh%sh%p' infile 
sh -c "ping -c 3 172.18.47.1"
sh -c ifconfig
sh -c "ethtool eth1"
sh -c "cat /proc/cpuinfo"
sh -c "dmidecode -t system"
sh -c "dmidecode -t bios"
sh -c uptime
sh -c "cat /proc/meminfo"
sh -c "cat /p--More-- (24% of 5110 bytes)
sh -c "uname -a"
sh -c "cat /proc/cmdline"
sh -c "ls /usr/java/"

Have your pick

theNbomr · 01-26-2013, 01:02 PM

In perl (untested)

Code:

#! /usr/bin/perl -w
use strict;
    while(<>){
        if( $_ =~ m/sh\s+/ ){
            print $&.$';
        }
    }

---- rod.

David the H. · 01-27-2013, 02:59 PM

Code:

grep -o 'sh -c.*$' infile

Assuming that the start of the pattern is always "sh -c", of course.