LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices



Reply
 
Search this Thread
Old 10-24-2004, 09:16 AM   #1
brumela
LQ Newbie
 
Registered: May 2004
Location: MB, Slovenia
Distribution: Fedora 1, Redhat 8, White box
Posts: 21

Rep: Reputation: 15
strange pipe behaviour


hi,

I want to extract IP address from string
Quote:
Oct 24 13:53:13 guliver sshd[29796]: Did not receive identification string from ::ffff:131.211.32.242
This string is from /var/log/secure, and I want to use it with iptables to block IPs that are testing ssh login.

Here is my problem. I'm tail-ing /var/log/secure with command
Quote:
tail -f /var/log/secure | awk '/Did not receive identification string from / {print $12}'

::ffff:211.180.157.251
::ffff:193.77.102.137
...
but when I add sed to remove pattern ::ffff:, output from pipe is empty

Quote:
tail -f /var/log/secure | awk '/Did not receive identification string from / {print $12}' | sed -e s/::ffff://
strange thing is that cat instead tail works perfectly
Quote:
cat /var/log/secure | awk '/Did not receive identification string from / {print $12}' | sed -e s/::ffff://

211.180.157.251
193.77.102.137
Where is the problem?
 
Old 10-24-2004, 10:55 AM   #2
mikshaw
LQ Addict
 
Registered: Dec 2003
Location: Maine, USA
Distribution: Slackware/SuSE/DSL
Posts: 1,320

Rep: Reputation: 45
You might need to escape the colons in order for them to be read properly:
sed -e s/\:\:ffff\://

Another option, if your input is always in this format, is to skip sed and just use awk with a specified field separator (a colon):
Code:
tail -f /var/log/secure | awk -F : '/Did not receive identification string from / {print $NF}'
 
Old 10-24-2004, 02:57 PM   #3
brumela
LQ Newbie
 
Registered: May 2004
Location: MB, Slovenia
Distribution: Fedora 1, Redhat 8, White box
Posts: 21

Original Poster
Rep: Reputation: 15
thanks for tip,
bat that didn't solve my problem
Quote:
tail -f /var/log/secure | awk -F : '/Did not receive identification string from / {print $NF}'
returns IP address, but command
Quote:
tail -f /var/log/secure | awk -F : '/Did not receive identification string from / {print $NF}' >> /path/file
don't write to file...
 
Old 10-24-2004, 04:21 PM   #4
homey
Senior Member
 
Registered: Oct 2003
Posts: 3,057

Rep: Reputation: 56
How about something like this ....

tail /var/log/secure | grep -e "Did not" | awk -F: '{print$4$7}'


Edit: I added the grep part to cut out the stuff you don't need.

Last edited by homey; 10-24-2004 at 05:50 PM.
 
Old 10-26-2004, 04:39 AM   #5
brumela
LQ Newbie
 
Registered: May 2004
Location: MB, Slovenia
Distribution: Fedora 1, Redhat 8, White box
Posts: 21

Original Poster
Rep: Reputation: 15
try to redirect output of
tail -f /var/log/secure | awk -F : '/Did not receive identification string from / {print $NF}'
to some file
tail -f /var/log/secure | awk -F : '/Did not receive identification string from / {print $NF}' >> /tmp/test

nothing happens, /tmp/test is empty, why?
 
Old 10-26-2004, 10:37 AM   #6
mikshaw
LQ Addict
 
Registered: Dec 2003
Location: Maine, USA
Distribution: Slackware/SuSE/DSL
Posts: 1,320

Rep: Reputation: 45
What is the purpose of "/Did not receive identification string from /"?
I tried it without this, and it seems to work. With that part included, I get no redirect
 
Old 10-26-2004, 11:59 AM   #7
brumela
LQ Newbie
 
Registered: May 2004
Location: MB, Slovenia
Distribution: Fedora 1, Redhat 8, White box
Posts: 21

Original Poster
Rep: Reputation: 15
please read the beginning of the thread
 
Old 10-26-2004, 01:54 PM   #8
mikshaw
LQ Addict
 
Registered: Dec 2003
Location: Maine, USA
Distribution: Slackware/SuSE/DSL
Posts: 1,320

Rep: Reputation: 45
Sorry, but that didn't answer my question. I don't know all uses for awk, so I don't understand why you added the "/Did not.../ " string to the awk command.
It would help a lot in fixing your problem, considering that when the string is removed, the awk and redirect work fine. I'm thinking it's a syntax problem.

So...what are you hoping to achieve by using
awk -F : '/Did not receive identification string from / {print $NF}'
instead of
awk -F : '{print $NF}'
?

I guess the question would be
What exactly do you want the output to look like?
 
Old 10-27-2004, 01:03 PM   #9
brumela
LQ Newbie
 
Registered: May 2004
Location: MB, Slovenia
Distribution: Fedora 1, Redhat 8, White box
Posts: 21

Original Poster
Rep: Reputation: 15
Quote:
Originally posted by mikshaw
Sorry, but that didn't answer my question. I don't know all uses for awk, so I don't understand why you added the "/Did not.../ " string to the awk command.
It would help a lot in fixing your problem, considering that when the string is removed, the awk and redirect work fine. I'm thinking it's a syntax problem.

So...what are you hoping to achieve by using
awk -F : '/Did not receive identification string from / {print $NF}'
instead of
awk -F : '{print $NF}'
?
with awk -F : '/Did not receive identification string from / {print $NF}'
I'm filtering lines with string "Did not receive identification string from"

Ok, I can do that also with grep before awk, but anyway
tail -f /tmp/test | awk -F : '{print $NF}' >> somefile
don't write to somefile

Quote:
I guess the question would be
What exactly do you want the output to look like?
I need to extract IP address from line:
Oct 24 13:53:13 guliver sshd[29796]: Did not receive identification string from ::ffff:131.211.32.242
and then store it to somefile
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Strange behaviour Anmol Suse/Novell 2 10-28-2005 12:05 AM
SCP strange behaviour sbalasuriya Linux - Software 0 09-21-2004 11:50 AM
Strange Mandrake 9.2 behaviour Erik Kuhlmann Linux - Security 3 03-26-2004 02:18 AM
Wierd behaviour using fork() and pipe() cybermix Programming 4 01-08-2004 04:44 AM
Strange Behaviour mikeyt_3333 Linux - General 4 08-06-2001 04:07 PM


All times are GMT -5. The time now is 05:23 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration