I'm trying to write a script that will scan the process tree for certain set of processes running longer than 12 hours.

Using the following string prints out the processes I'm interested in.

CODE:
for i in `cat glist `; do ps -e -o user,pid,etime,comm | grep $i| grep -v httpd |grep -v sidd ; done

RESULTS:
edihub01 11559 13:27:54 w10_nextHtml.cg
edihub01 12157 13:24:50 w04_doOB.cgi
pos01 14259 1-02:54:51 ver3_ProcTimeIn

Now I need to check against that output and grep, well I'm trying to use grep, those that are older than 12 hours.

Obviously all three are in this case, which is fine so I isolate the etime field:

CODE:
for i in `cat glist `; do ps -e -o user,pid,etime,comm | grep $i| grep -v httpd |grep -v sidd | awk '{print $3}'; done

RESULTS:
13:29:35
13:26:31
1-02:56:32

Now I try to grep within that output using the following...

CODE:
for i in `cat glist `; do ps -e -o user,pid,etime,comm | grep $i| grep -v httpd |grep -v sidd | awk '{print $3}' | grep *[12-23]:[0-9][0-9]:[0-9][0-9]; done

RESULTS:
"Nothing"

I'm trying to setup the grep to say "anything over 12 hours and 00 minutes and 00 seconds" display

What am I doing wrong? Why isn't this working like I expect?

Hi,

This: grep *[12-23]:[0-9][0-9]:[0-9][0-9]
Should be: grep [12-23]:[0-9][0-9]:[0-9][0-9] (* is removed).

You could also combine some of the statements:
grep -v httpd |grep -v sidd
becomes:
egrep -v "httpd|sidd"

awk '{print $3}' | grep [12-23]:[0-9][0-9]:[0-9][0-9]
Becomes
awk '/[12-23]:[0-9][0-9]:[0-9][0-9]/ {print $3}'

You'll end up with:

for i in `cat glist `; do ps -e -o user,pid,etime,comm | grep $i| egrep -v "httpd|sidd" | awk '/[12-23]:[0-9][0-9]:[0-9][0-9]/ {print $3}'; done

Hope this helps.

The [] in regular expressions does not mean integer range, it means a list of characters, e.g. [abc] matches a b or c. The [a-c] is a short way of saying "all the characters between a and c inclusive", and works with letters and numbers. [12-23] therefore matches the single character 1, 2, or 3 (because "2-2" is shortened to simply "2"). The * is to be used after a pattern, not before, and indicates "0 or more occurrences of the previous pattern).

You could split the pattern up a little to help the thinking process.
You could provide each of these patterns separately using multiple -e options to grep, and enclosing the patterns in quotes - if you happen to have a file in the working directory whose names matches the pattern you are grepping for, the shell will do the substitution and then pass the file name to grep as the pattern, which can cause nasty unexpected behaviour.
You could also consolidate them into a single pattern, using (pattern1|pattern2|pattern3) for the parts which vary, and use egrep, which supports this extended RE type. Personally I prefer using multiple -e options as it is clearer, but if you want to do it all in one, here's how:

I know why it doesn't work, but don't do enough with regular expressions to tell you how to fix it. You problem is that a regular expression does not understand two digit numbers. You can tell it 12, but it is looking litterly for 1 followed by a 2. It doesn't start at 12 and look for 13, 14, 15, ... it just doesn't work that way. You might want something like ...

That should translate to 12-23, though as I've said, I don't use regular expressions often.

Maybe a little off topic, but if you have a list of process names in glist, you can shorten the ps command as in
--no-headers do not print the header line
-C search processes by command name
and in the output part you can put only etime. In this way you don't need the grep -v httpd |grep -v sidd | awk '{print $3}' part.

Hi,

@matthewg42: You are absolutely correct !! (dumb I overlooked that......).

KICK BUTT! Thanks Matt.

Could you do me a favor now and explain that last code segment to me so I can learn to fish?

He kind of spells it out in the first section of code. The only difference is that instead of being three separate statements, he condenses it down to one statement. This was done by taking everything that as dis-similar (the days and hours), and putting them in parenthesis, and everything that was similar (minutes/seconds), and keeping them outside of the parenthesis. The parenthesis creates a group that regexp interprets as "one of these" (these separated by a bar '|'), followed by the rest of the expression.

Hope that makes it a bit clearer.

More formally, (pattern1|pattern2|pattern3) matches if pattern1 or pattern2 or pattern3 matches. The | is a logical or, the parenthesis group the sub-patterns in the or.