LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-16-2016, 03:18 AM   #1
jogyulas
Member
 
Registered: May 2014
Location: Hungary
Posts: 32

Rep: Reputation: Disabled
regex with and operator is it possible?


Hi guys,

My question maybe not only a Linux specific question but I hope you can help me.
I would like to catch two patterns in a text with AND logical operator if it is possible.
For example here it is a windows security event log which I want to store on Linux:

"User: Security Microsoft Windows security auditing.: [Success Audit] A network share object was checked to see whether client can be granted desired access.
(EventID 5145)"

Unfortunately windows EventID 5145 arrives with [Success Audit] and [Failure Audit] result but only what I need the [Failure Audit] with 5145 event id. So I have to do it with AND logical operator somehow but I can't so far. I have searched a lot on the internet and unfortunately I haven't found any good solution for it.

Can someone help me in it? Thanks in advance
 
Old 12-16-2016, 03:27 AM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 18,495

Rep: Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099
Yes.
Show us what you have attempted (and the results) and we will then have something to work with.
 
Old 12-16-2016, 03:34 AM   #3
jogyulas
Member
 
Registered: May 2014
Location: Hungary
Posts: 32

Original Poster
Rep: Reputation: Disabled
Honestly I am not familiar with regex so I dont have any attempt. I tried to surf on the internet and check e.g http://regexr.com/ this or similar sites but I didnt find solution. Sry for my inexperienced attitude
 
Old 12-16-2016, 04:33 AM   #4
grail
LQ Guru
 
Registered: Sep 2009
Location: Perth
Distribution: Manjaro
Posts: 9,769

Rep: Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052
Maybe we should step back one step and ask what tool are you going to be using to perform the task of extracting the data? Also, will it be coming from a file or a stream of data?

Ultimately this will not alter the regex all that much and you will need to show that you have made an attempt to solve this.

You might be interested to look at :- http://www.rubular.com/

Here you can paste in your test string and then build up the regex required to match it. It also lists many of the familiar options that can be used.
So have a few tries and come back and show us what has got you close and we will help you over the line with a solution
 
Old 12-16-2016, 05:43 AM   #5
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 18,495

Rep: Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099
grep is usually the CLI tool of choice for simple text searching. If that text is over 2 records, it doesn't qualify as "simple" in this context. There are multi-line grep variants that may be useful.
Personally I might be inclined to use sed, but any language that support logic test will suffice (awk, perl, python, lua ...)
 
Old 12-16-2016, 06:09 AM   #6
jogyulas
Member
 
Registered: May 2014
Location: Hungary
Posts: 32

Original Poster
Rep: Reputation: Disabled
@grail
Thank you for your response
It is an syslog agent which work as a service on windows device and transfers data to a remote syslog server. Therefore it is a stream of data.
I have checked your link and I have tried to do something. Firstly I tried it with | operator but it didn't work. Then I tried this: (^Success|5145) but it didn't work either. Honestly I don't know how to use regex with AND operator, I mean two different patterns at two different locations in the same message and I would like to match it only these two patterns.

@syg00
I have to create this regex in syslog-ng-agent (balabit) on windows side. So I cant use grep or any other useful tool. The only thing that I can use regex, and I dont know how to do it :- / Sry
 
Old 12-16-2016, 06:30 AM   #7
grail
LQ Guru
 
Registered: Sep 2009
Location: Perth
Distribution: Manjaro
Posts: 9,769

Rep: Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052Reputation: 3052
So, I was unaware that the data was actually on 2 lines, my wrong assumption was that the example had just run off the end of the line and was continuing on the next.

As you have advised that you are unable to use known tools, you will need to investigate syg00 information on whether or not the tool you are able to use is able to read multiple lines, I would think using '\n'
to navigate to the next line, or is able to store found data until the following line can be searched.

Try going back to the link I provided and using '\n' to see how it would join together 2 lines of data and then see if that can be used in your application?

Your regex will be along the lines:

1. Find first part of string
2. Get Everything up until the end of the line
3. Include the end of the line
4. Get everything up until the next part you need to find

See how you go?
 
Old 12-16-2016, 10:28 AM   #8
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,362

Rep: Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001
There are some rather messy ways to do multi-line matches with grep, but other tools are more suitable. It's pretty simple with awk or perl, and is even fairly straightforward with sed:
Code:
sed -n '/(EventID 5145)/{H;x;s/\[Failure Audit\]/&/p;t};h'
Explanation:
For lines that match the string "(Event ID 5145)",
  1. Append the line to whatever is currently in the hold space,
  2. Exchange the content of the hold space with the current line space,
  3. Look for the string '[Failure Audit]', replace it with itself, and print the current space if the substitution occurred,
  4. Jump to the end of the script.
Otherwise, save the current line in the hold space.
 
Old 12-16-2016, 05:03 PM   #9
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 18,495

Rep: Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099Reputation: 3099
Quote:
Originally Posted by jogyulas View Post
I have to create this regex in syslog-ng-agent (balabit) on windows side. So I cant use grep or any other useful tool. The only thing that I can use regex
First thing you need to determine is if that data you showed is two (separate) lines or is just word-wrap. Being in double-quotes, maybe it is one line. You (we) have to be sure.

A quick look at the doco shows filter should work if all on one line (at the Windows source) - maybe something like
Code:
match("[Failure Audit]") and match("(EventID 5145)")
No need for regex at all.
If it truly is over 2 lines, I can't help - I didn't see any indication of how to delay a message while the next is tested.
I did see mention of PCRE support, but the doco is appalling.

Last edited by syg00; 12-16-2016 at 05:04 PM. Reason: cleanup match()
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Confusing issue with Perl regEx - Regex check seems to require variable being set EnderX Programming 1 09-07-2013 05:36 AM
[SOLVED] differences between shell regex and php regex and perl regex and javascript and mysql golden_boy615 Linux - General 2 04-19-2011 02:10 AM
[SOLVED] C++ Operator Overloading Within an Already Overloaded Operator mirlin510 Programming 8 04-17-2011 01:02 PM
Perl to find regex and print following 5 lines after regex casperdaghost Linux - Newbie 3 08-29-2010 09:08 PM
regex with sed to process file, need help on regex dwynter Linux - Newbie 5 08-31-2007 06:10 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 08:15 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration