[SOLVED] how to extract a 2-line pattern from a file using awk, grep, etc.

dcsmayei · 06-08-2012, 03:36 AM

1. I want to identify usernames with the same password which is a security/audit issue.
2. The audit script output tests all such connections to the server database having the same password.
3. I need to extract only the usernames that connect successfully so that these passwords can be addressed. I know how to change passwords

4. Here is a sample of the huge output file:
SQL> connect AA/AA;
Connected.
SQL> connect B4B/B4B;
ORA-28000: the account is locked
Warning: You are no longer connected to ORACLE.
SQL> connect CCg/CCg;
ORA-01017: invalid username/password; logon denied
SQL> connect Dee/Dee;
Connected.
SQL> connect eR/eR;
ORA-28000: the account is locked
Warning: You are no longer connected to ORACLE.
SQL> connect Fdw2/Fwd2;
ORA-01017: invalid username/password; logon denied
Warning: You are no longer connected to ORACLE.
SQL> connect gAMw/gAMw;
Connected.

5. I would like an output file similar to this after pattern searching (i.e. only the connected usernames):
SQL> connect AA/AA;
Connected.
SQL> connect Dee/Dee;
Connected.
SQL> connect gAMw/gAMw;
Connected.

NB: the search should have nothing to do with usernames starting with an alphabet.

Much obliged,
Waiting in anticipation!

pan64 · 06-08-2012, 03:46 AM

You can use: awk ' BEGIN { RS="SQL>" } ... ' and you will get the info in one line. You can use /Connected/ to find successful logins....

dcsmayei · 06-08-2012, 04:00 AM

Thx Pan64.
Apologies I'm a beginner with awk.

Kindly explain to me how to just get the connected usernames from the output file.
By that I mean, after awk or whatever command or script, I get an output file as follows or similar:
SQL> connect AA/AA;
SQL> connect Dee/Dee;
SQL> connect gAMw/gAMw;

Tx

pan64 · 06-08-2012, 04:04 AM

something like this:

Code:

awk ' BEGIN { RS="SQL>" }
      /Connected/ { print "SQL> connect " $2 } ' inputfile

_____________________________________
If someone helps you, or you approve of what's posted, click the "Add to Reputation" button, on the left of the post.
Happy with solution ... mark as SOLVED
(located in the "thread tools")

dcsmayei · 06-08-2012, 04:19 AM

tx for the expanded command.

I now get the following output:
SQL> connect connect
SQL> connect Connected.
SQL> connect connect
SQL> connect connect
SQL> connect connect
SQL> connect Connected.
SQL> connect connect

instead of the three connected usernames as in my first posting?

pls help!

dcsmayei · 06-08-2012, 05:01 AM

i guess nobody knows the answer to my question!!

or did I not not explain it well enough??

hello Q&A forum????

pan64 · 06-08-2012, 06:00 AM

it works fine for me, so probably you mistyped something or you have a different environment. Try to replace $2 with $1 or $3 and start again....

_____________________________________
If someone helps you, or you approve of what's posted, click the "Add to Reputation" button, on the left of the post.
Happy with solution ... mark as SOLVED
(located in the "thread tools")

Refractor · 06-08-2012, 06:51 AM

From grep's man page:

Code:

   Context Line Control
       -A NUM, --after-context=NUM
              Print  NUM  lines of trailing context after matching lines.  Places a line containing a group
              separator (--) between contiguous groups of matches.  With the -o or --only-matching  option,
              this has no effect and a warning is given.

       -B NUM, --before-context=NUM
              Print  NUM  lines of leading context before matching lines.  Places a line containing a group
              separator (--) between contiguous groups of matches.  With the -o or --only-matching  option,
              this has no effect and a warning is given.

So just grep -B1 Connected <FILENAME> to get your results and please, restrain yourself from posts like http://www.linuxquestions.org/questi...9/#post4698608 some of us find it offensive. Especially when you didn't look at the documentation. Have a great day!

dcsmayei · 06-08-2012, 07:51 AM

Thank u guys! $3 worked!

colucix · 06-09-2012, 08:32 AM

Quote:

Originally Posted by dcsmayei

i guess nobody knows the answer to my question!!

or did I not not explain it well enough??

hello Q&A forum????

May I ask what is the reason of such a rude comment? You posted this only 42 minutes after your last feedback. Maybe your issue was so urgent that you feel justified in addressing LQ members like that?!? Please, refrain from this behavior in the future and try to apply a bit of netiquette.