LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices

Reply
 
Search this Thread
Old 06-24-2009, 03:52 AM   #1
jeesun
Member
 
Registered: Aug 2007
Location: Australia
Distribution: RedHat Enterprise
Posts: 82

Rep: Reputation: 15
Grep file using last specific file patterns


I have a system file, which contains the system event notification information details cumulatively. And the file contains the information in every event begin with

>------------ Event Monitoring Service Event Notification ------------<

and end like

>---------- End Event Monitoring Service Event Notification ----------<

I need to write a script which will read the last event of file which are begin in
>------------ Event Monitoring Service Event Notification ------------<
and end in
>---------- End Event Monitoring Service Event Notification ----------<

how can I read the last event of file not using "tail" but matching between the last "Event Monitoring Service Event Notification" and "End Event Monitoring Service Event Notification".

Any input will be highly appreciated.
 
Old 06-24-2009, 05:15 AM   #2
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,498

Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
Code:
awk '/- Event/{delete a}
     /- Event/,/End Event/{a[count++]=$0}
     END{for (i in a) print a[i]}' file
Using your post as input file:
Code:
awk '/- Event/{delete a}
>    /- Event/,/End Event/{a[count++]=$0}
>    END{for (i in a) print a[i]}' file
>------------ Event Monitoring Service Event Notification ------------<
and end in
>---------- End Event Monitoring Service Event Notification ----------<
 
Old 06-24-2009, 05:24 AM   #3
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,268

Rep: Reputation: 1028Reputation: 1028Reputation: 1028Reputation: 1028Reputation: 1028Reputation: 1028Reputation: 1028Reputation: 1028
Nice.
colucix, you are going to convince me I need to learn to use awk properly.
We agreed on the (form of) the solution, but I'd never have done it so succinctly.
 
Old 06-24-2009, 05:27 AM   #4
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,498

Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
He he.. let's wait for ghostdog74's solution: his awk codes are even more succinct than mine!
 
Old 06-24-2009, 06:16 AM   #5
jeesun
Member
 
Registered: Aug 2007
Location: Australia
Distribution: RedHat Enterprise
Posts: 82

Original Poster
Rep: Reputation: 15
Make me more clarification.

I need the last description of the file after ">------------ Event Monitoring Service Event Notification ------------<" and up to ">---------- End Event Monitoring Service Event Notification ----------<"

between the above quotations I need the inside description.
 
Old 06-24-2009, 06:44 AM   #6
ghostdog74
Senior Member
 
Registered: Aug 2006
Posts: 2,695
Blog Entries: 5

Rep: Reputation: 241Reputation: 241Reputation: 241
not nearly as good as colucix's, here's another way
Code:
awk 'BEGIN{ RS="- Event"; FS="-<"}END{sub(/>-.*/,"",$2);print $2}' file

Last edited by ghostdog74; 06-24-2009 at 09:10 AM.
 
Old 06-24-2009, 07:09 AM   #7
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,498

Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
Quote:
Originally Posted by jeesun View Post
Make me more clarification.

I need the last description of the file after ">------------ Event Monitoring Service Event Notification ------------<" and up to ">---------- End Event Monitoring Service Event Notification ----------<"

between the above quotations I need the inside description.
Just don't print the first and the last element of the array:
Code:
awk '/- Event/{delete a; count=0}
     /- Event/,/End Event/{a[++count]=$0}
     END{for (i=2; i<length(a); i++) print a[i]}' file
Take in mind that length(a), where a is an array, returns the number of elements in the array but only in recent versions of gawk.
 
Old 06-24-2009, 08:22 AM   #8
micxz
Senior Member
 
Registered: Sep 2002
Location: CA
Distribution: openSuSE, Cent OS, Slackware
Posts: 1,131

Rep: Reputation: 75
colucix Just pasting the code for my snippet library I tried both but the last one (with length()) I get:

awk: cmd. line:2: (FILENAME=file FNR=11) fatal: attempt to use array `a' in a scalar context
 
Old 06-24-2009, 08:41 AM   #9
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,498

Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
Quote:
Originally Posted by micxz View Post
colucix Just pasting the code for my snippet library I tried both but the last one (with length()) I get:

awk: cmd. line:2: (FILENAME=file FNR=11) fatal: attempt to use array `a' in a scalar context
Which version of awk do you have? Maybe the length function is limited to retrieving the length of a string and length of arrays is not supported. Take in mind that it is a GNU awk extension and that older version of gawk does not support this feature. It works with my version 3.1.5.
 
Old 06-24-2009, 08:54 AM   #10
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,498

Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
Here is another version that does not use the length(a) function:
Code:
awk '/- Event/{delete a; count=0}
     /- Event/,/End Event/{a[++count]=$0}
     END{for (i=3; i<=NR; i++) if (i in a) print a[i-1]}' file
 
Old 06-24-2009, 06:45 PM   #11
micxz
Senior Member
 
Registered: Sep 2002
Location: CA
Distribution: openSuSE, Cent OS, Slackware
Posts: 1,131

Rep: Reputation: 75
Awesome!
 
Old 06-25-2009, 03:45 AM   #12
jeesun
Member
 
Registered: Aug 2007
Location: Australia
Distribution: RedHat Enterprise
Posts: 82

Original Poster
Rep: Reputation: 15
Sorry guys, no success yet.

for an example i'm giving you the text file sample. This is the last entry of my file


>------------ Event Monitoring Service Event Notification ------------<

Notification Time: Fri Jun 19 18:21:35 2009

blbiltst sent Event Monitor notification information:

/adapters/events/TL_adapter/0_6_1_0 is >= 1.
Its current value is INFORMATION(1).



Event data from monitor:

Event Time..........: Fri Jun 19 18:21:34 2009
Severity............: INFORMATION
Monitor.............: dm_TL_adapter
Event #.............: 18
System..............: server

Summary:
Adapter at hardware path 0/6/1/0 : Received an interrupt indicating that a
primitive was transmitted



>---------- End Event Monitoring Service Event Notification ----------<

i want to get the last description quoted between ">------------ Event Monitoring Service Event Notification ------------<" and ">---------- End Event Monitoring Service Event Notification ----------<"

But i never know which description will come last. I actually need this.
 
Old 06-25-2009, 04:01 AM   #13
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,498

Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
What does not work? Given your example description (I put in two descriptions with a slight difference inside them and some additional lines to be excluded), here is what I get:
Code:
$ cat testfile
line excluded
line excluded
>------------ Event Monitoring Service Event Notification ------------<

Notification Time: Fri Jun 19 18:21:35 2009

blbiltst sent Event Monitor notification information:

/adapters/events/TL_adapter/0_6_1_0 is >= 1.
line excluded
Its current value is INFORMATION(1).



Event data from monitor:

Event Time..........: Fri Jun 19 18:21:34 2009
Severity............: INFORMATION
Monitor.............: dm_TL_adapter
Event #.............: 18
System..............: server

Summary:
Adapter at hardware path 0/6/1/0 : Received an interrupt indicating that a
primitive was transmitted



>---------- End Event Monitoring Service Event Notification ----------<
line excluded
line excluded
>------------ Event Monitoring Service Event Notification ------------<

Notification Time: Fri Jun 19 18:21:35 2009

blbiltst sent Event Monitor notification information:

/adapters/events/TL_adapter/0_6_1_0 is >= 1.
line included
Its current value is INFORMATION(1).



Event data from monitor:

Event Time..........: Fri Jun 19 18:21:34 2009
Severity............: INFORMATION
Monitor.............: dm_TL_adapter
Event #.............: 18
System..............: server

Summary:
Adapter at hardware path 0/6/1/0 : Received an interrupt indicating that a
primitive was transmitted



>---------- End Event Monitoring Service Event Notification ----------<
line excluded
line excluded

$ awk '/- Event/{delete a; count=0}
     /- Event/,/End Event/{a[++count]=$0}
     END{for (i=1; i<=NR; i++) if (i in a) print a[i]}' testfile
>------------ Event Monitoring Service Event Notification ------------<

Notification Time: Fri Jun 19 18:21:35 2009

blbiltst sent Event Monitor notification information:

/adapters/events/TL_adapter/0_6_1_0 is >= 1.
line included
Its current value is INFORMATION(1).



Event data from monitor:

Event Time..........: Fri Jun 19 18:21:34 2009
Severity............: INFORMATION
Monitor.............: dm_TL_adapter
Event #.............: 18
System..............: server

Summary:
Adapter at hardware path 0/6/1/0 : Received an interrupt indicating that a
primitive was transmitted



>---------- End Event Monitoring Service Event Notification ----------<
If you don't want the header lines:
Code:
$ awk '/- Event/{delete a; count=0}
     /- Event/,/End Event/{a[++count]=$0}
     END{for (i=3; i<=NR; i++) if (i in a) print a[i-1]}' testfile

Notification Time: Fri Jun 19 18:21:35 2009

blbiltst sent Event Monitor notification information:

/adapters/events/TL_adapter/0_6_1_0 is >= 1.
line included
Its current value is INFORMATION(1).



Event data from monitor:

Event Time..........: Fri Jun 19 18:21:34 2009
Severity............: INFORMATION
Monitor.............: dm_TL_adapter
Event #.............: 18
System..............: server

Summary:
Adapter at hardware path 0/6/1/0 : Received an interrupt indicating that a
primitive was transmitted
If the above does not match your requirement, can you post an example of the desired output? Using CODE tags, please.
 
Old 06-25-2009, 04:35 AM   #14
jeesun
Member
 
Registered: Aug 2007
Location: Australia
Distribution: RedHat Enterprise
Posts: 82

Original Poster
Rep: Reputation: 15
When I run the command, it gives me the following error

awk '/- Event/{delete a; count=0}
> /- Event/,/End Event/{a[++count]=$0}
> END{for (i=3; i<=NR; i++) if (i in a) print a[i-1]}' testfile
syntax error The source line is 1.
The error context is
/- Event/{delete >>> a; <<<
awk: The statement cannot be correctly parsed.
The source line is 1.
 
Old 06-25-2009, 04:58 AM   #15
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,498

Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
So you're not using the GNU awk, aren't you? Indeed the ability to delete a whole array using
Code:
delete array
is a gawk extension. The following code should work for you:
Code:
nawk '/- Event/{for (i in a) delete a[i]; count=0} \
      /- Event/,/End Event/{a[++count]=$0} \
      END{for (i=3; i<=NR; i++) if (i in a) print a[i-1]}' testfile
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
grep for string in file after a certain part of the file B-Boy Programming 6 02-18-2009 07:49 AM
grep patterns tekmann33 Linux - Newbie 2 07-14-2008 01:25 PM
--exclude-from=FILE excluding patterns complications cucolin@ Linux - Server 7 04-06-2007 12:35 PM
selecting patterns in file manjushp Programming 15 09-10-2005 08:43 AM
Searching patterns from file MichaelVaughn Programming 1 04-06-2004 11:18 AM


All times are GMT -5. The time now is 12:42 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration