Error on awk script

sebelk · 10-14-2009, 01:34 PM

I have log files that looks like below:

Sat Oct 3 11:42:29 2009 : Auth: Login OK: [dpefpe (from client Alpha-2 port 0 via TLS tunnel)
Sat Oct 3 11:47:25 2009 : Auth: Login OK: [bfraser2] (from client Omega port 0 via TLS tunnel)
Sat Oct 3 11:57:54 2009 : Auth: Login OK: [fzoppi] (from client Omega port 0 via TLS tunnel)
Sat Oct 3 11:59:29 2009 : Auth: Login OK: [fzoppi] (from client Epsilon port 0 via TLS tunnel)
Sat Oct 3 12:02:00 2009 : Auth: Login OK: [agfffzoppfi] (from client Beta port 0 via TLS tunnel)
Sat Oct 3 12:03:03 2009 : Auth: Login OK: [gjanfez] (from client Delta port 0 via TLS tunnel)
Sat Oct 3 12:06:59 2009 : Auth: Login OK: [carmefnafp] (from client Gamma port 0 via TLS tunnel)

END OF SAMPLE

I want to get the amount of users that got OK (field 9) classified by client

#! /usr/bin/awk -f
BEGIN {
client[0] = "Alpha"
client[1] = "Beta"
client[2] = "Gamma"
client [3] = "Delta"
client [4] = "Epsilon"
client [5] = "Omega"

for(key in client){
{if($9 ~ /OK/ && $13 ~ /client[key]/)

{print $10} | sort -fu | wc -l
}
}
}

END of Script

But that exits with the followinf error:

$ ./qqq /var/log/radius/radiusd-inner-tunnel-20091003.log
awk: ./qqq:13: {print $10} | sort -fu | wc -l
awk: ./qqq:13: ^ syntax error
awk: ./qqq:13: {print $10} | sort -fu | wc -l
awk: ./qqq:13: ^ syntax error

Please could you help me to fix it?

Thanks in advance!

wfh · 10-14-2009, 01:50 PM

Using your original log entries (myfile) I get this:

fgrep OK myfile|awk '{print $13}'|sort -u|wc

5 5 33

ghostdog74 · 10-14-2009, 06:44 PM

of course you will get errors. You are mixing shell commands inside awk.

sebelk · 10-15-2009, 06:52 AM

Quote:

Originally Posted by ghostdog74

of course you will get errors. You are mixing shell commands inside awk.

OK, ok, but even if I use:

Code:

#! /usr/bin/awk -f
BEGIN {
        client[0] = "Alpha"
        client[1] = "Beta"
        client[2] = "Gamma"
        client [3] = "Delta"
        client [4] = "Epsilon"
        client [5] = "Omega"

        for(key in client){
                {if($9 ~ /OK/ && $13 ~ /client[key]/)

                        {print $10}
                }
        }
}

I get nothing! I expect that print 10th field (username)...

PMorph · 10-15-2009, 02:31 PM

Dunno why that doesn't work (can't use variables as regexp?), but it seems to work if you replace:
if($9 ~ /OK/ && $13 ~ /client[key]/)

with:
if($9 ~ /OK/ && match($13, client[z]))

Edit: Scratch that.. your original form works if you just remove the slashes around the client[key]

ghostdog74 · 10-15-2009, 07:31 PM

Hint: field variables $1...$n are only available outside the BEGIN block.

sebelk · 10-16-2009, 07:44 AM

Thanks everyone, at the end I've found a way to do that almost all in a mix of bash, awk and GNU tools:

Code:

for i in "(.*Alpha.*)" "(.*Beta.*)" "(.*Gamma.*)" "(*.Deltha.*)" 
"(*.Gamma.*)" "(*.Epsilon.*)"; do grep $i "/var/log/radius/radiusd-inner-
tunnel-20090925.log" | echo "$i": $(awk '$9 ~ OK {print  $10 }'   | sort -
fu| wc -l); done