LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Sed script within bash script produces unexpecte EOF error (https://www.linuxquestions.org/questions/linux-newbie-8/sed-script-within-bash-script-produces-unexpecte-eof-error-4175653937/)

Kgeil 05-15-2019 06:25 AM

Sed script within bash script produces unexpecte EOF error
 
Hi, I have a sed script which runs just fine at the command prompt, but when I include it in a bash script, it fails with: unexpected EOF while looking for matching `"' As always, any help or suggestions are greatly appreciated. It might take me an hour or two to reply to comments, thank you.

I'm working in Ubuntu 16.04

The script will eventually change two patterns within a log line (the combined sed command is commented out). The sed line is:


Code:

sed -i -r "s#INIT\][0-9]{4}\s[A-Z][a-z]{2}\s[0-9]+#INIT]$ymdDate#g" $1
The script is as follows:

Code:

#!/bin/bash

if [ "$1" = "" ]; then
    echo "ERROR: Please enter filename '\n' Example: change-ossec-alertDate.sh myalerts.log "
else
#today= `date "+%s" | cut -c1-6`
today=$(date "+%s" | cut -c1-6)
ymdDate=$(date "%Y %b %d)

echo "today = $today"
# the first part of the sed command below (before the ";") works fine
# sed -i -r  "s#AV - Alert - \"[0-9]{6}#AV - Alert - \"$today#g;s#INIT\][0-9]{4}\s[A-Z][a-z]{2}\s[0-9]+#INIT]$ymdDate#g" $1

# the line below works at the prompt, but fails in a script
sed -i -r "s#INIT\][0-9]{4}\s[A-Z][a-z]{2}\s[0-9]+#INIT]$ymdDate#g" $1


fi



And last but not lease, here is the sample text:

Code:

AV - Alert - "1557833239" --> RID: "110021"; RL: "2"; RG: "windows,applocker,"; RC: "Applocker audit mode program would have been blocked"; USER: "None"; SRCIP: "None"; HOSTNAME: "(DC1) 10.101.4.210->WinEvtLog"; LOCATION: "(DC1) 10.101.4.210->WinEvtLog"; EVENT: "[INIT]2019 May 14 07:53:51 WinEvtLog: Microsoft-Windows-AppLocker/EXE and DLL: Warning(8003): no source: KevinAdmin: TESTDOMAIN: 2012R2-DC1.testdomain.local: %SYSTEM32%\MMC.EXE was allowed to run but would have been prevented from running if the AppLocker policy were enforced.[END]";

Thanks again,


Kevin

pan64 05-15-2019 06:39 AM

Code:

ymdDate=$(date "%Y %b %d)
this line is just wrong

Kgeil 05-15-2019 07:04 AM

Quote:

Originally Posted by pan64 (Post 5995222)
Code:

ymdDate=$(date "%Y %b %d)
this line is just wrong

If you could share why you make that statement, I would appreciate it.

Thanks

berndbausch 05-15-2019 07:39 AM

Quote:

Originally Posted by Kgeil (Post 5995227)
If you could share why you make that statement, I would appreciate it.

The line has an unbalanced quote character.

After adding the missing second quote, your EOF error will turn in an error issued by the date command. What precise error will be issued probably depends on where you will put your second quote. You may want to re-read the manual page for date.

pan64 05-15-2019 08:31 AM

I suggest you to use shellcheck.net to check your script. That will help you to solve your issues (except the date format - see man date).

Kgeil 05-15-2019 08:55 AM

Thanks for the great advice from both of you! shellcheck.net is totally awesome. Of course, my date formatting was an issue, but my biggest issue was not really thinking through what the EOF error was telling me. I was focused on the wrong line of code the whole time...

Thanks again,
Kevin

My new script is below. Advice is still appreciated, but it does work as intended.

Code:

#!/bin/bash

if [ "$1" = "" ]; then
    printf 'ERROR: Please enter filename \n Example: change-ossec-alertDate.sh myalerts.log '
else

today=$(date "+%s" | cut -c1-6)
ymdDate=$(date '+%Y %b %d')

echo "ymdDate = $ymdDate"

echo "today = $today"

sed -i -r  "s#AV - Alert - "[0-9]{6}#AV - Alert - "$today#g;s#INIT\][0-9]{4}\s[A-Z][a-z]{2}\s[0-9]+#INIT]$ymdDate#g" "$1"



fi


Turbocapitalist 05-15-2019 08:59 AM

You can try adding the following as the second line of the script:

Code:

set -x
That will give you a preview of each line exactly as the script plans to execute. Then you can see how what it actually produces diverges from what you expected it to do.

Kgeil 05-15-2019 09:34 AM

Quote:

Originally Posted by Turbocapitalist (Post 5995279)
You can try adding the following as the second line of the script:

Code:

set -x
That will give you a preview of each line exactly as the script plans to execute. Then you can see how what it actually produces diverges from what you expected it to do.

Thanks. That's another awesome debugging tool!

chrism01 05-16-2019 12:41 AM

I usually use 'set -xv' ;) YMMV


All times are GMT -5. The time now is 03:46 PM.