Removing non-unique record in nawk

omega71122 · 05-01-2006, 10:54 AM

Hi all,

We have our Windows clients configured to report to a UNIX syslog server. We want to parse that log file using nawk to keep a list of who is logged on. The list is going to be in a plain-text file. What I need to be able to do is remove only one entry from the file that is not unique using nawk and any system commands or utilities available. Example input from the file:

Code:

Apr-28-machine-logon-jsmith
Apr-28-machine-logon-jsmith
Apr-28-machine-logon-jsmith

The script then sees this line in the log file it parses:

Code:

Apr-28-machine-logoff-jsmith

and we want it to remove only one instance of the corresponding logon entry, leaving the other 2, so that when

Code:

Apr-28-machine-logoff-jsmith
Apr-28-machine-logoff-jsmith

shows up in the log file it parses, it will remove the other 2.

Basically, we want the script to only remove one instance of the "logon" entry for each logoff entry. I've looked at sort, uniq, nawk, and a few other methods, without ideas. What does that community have to say?

Thanks everyone!

jonaskoelker · 05-01-2006, 05:46 PM

Okay, so exactly what is the spec? Let me see if I got it straight: For each line in the input file, if it hasn't been output before, output it.

If that's the effect you want, the following python script does it:

Code:

#!/usr/bin/python
try: set
except NameError: from sets import Set as set
from sys import stdin, stdout

lines = set()
for line in stdin:
    if line not in lines:
        lines.add(line)
        print line,

save it as script.py, then run it as "python script.py < inputfile". Or change the hash-bang path and chmod +x it, and run it as "/path/script.py < inputfile". It should work with both python 2.3 and 2.4

hth --Jonas

omega71122 · 05-02-2006, 09:38 AM

Basically we want the the file the script creates (/var/log/currentusers) to contain only logon entries. When the script sees a logoff entry in the syslog file (in this case /var/log/windowslog/current), we want it to remove an instance of the corresponding logon in the currentusers file. In the end, we want to be able to look at the currentusers file to quickly tell who's logged on.

I wish there was a way I could call nawk recursively...

jonaskoelker · 05-02-2006, 09:43 AM

Ah. I misunderstood that, then.

Have a look at who, w, utmp and wtmp. Will they do the job?

omega71122 · 05-03-2006, 10:45 AM

Currently we use who, but due to samba sessions that tend to "hang" (as in they stay active after the user logs out), we're looking for something a bit more accurate.