Help on parsing a log file in BASH

globemast · 01-09-2007, 03:09 PM

Hello,

I have a log file created from iptables, which tracks NAT'd connections on my network.

gre 47 431990 timeout=600, stream_timeout=432000 src=192.168.4.231 dst=x.x.x.x srckey=0x0 dstkey=0xc3e7 packets=15665 bytes=1433523 src=x.x.x.x dst=10.104.12.43 srckey=0xc3e7 dstkey=0x595 packets=18604 bytes=6852134 [ASSURED] use=1 rate=70 mark=0

The above line is an example of a line from the log file for a GRE connection.

Is it possible to help me parse such a line in a BASH shell in order to receive the source ip and destination ip in two variable $SRC and $DEST ???

Thank you in advanced.

raskin · 01-09-2007, 03:34 PM

I would do the following:

Code:

DEST=$(echo "$LINE" | sed -e 's/ /\n/g' | grep 'dst=\([0-9]\{1,3\}[.]\)\{3,3\}[0-9]\{1,3\}' | sed -e 's/dst=//');
SRC=$(echo "$LINE" | sed -e 's/ /\n/g' | grep 'src=\([0-9]\{1,3\}[.]\)\{3,3\}[0-9]\{1,3\}' | sed -e 's/src=//');

Not the best performance possible, though.. Maybe awk will do better. By the way, are addresses with x.x.x.x always in the middle? If yes, then a better script is possible.

globemast · 01-10-2007, 01:19 AM

Hi, yes there are two address fields one next to the other...Besically i subtituted the second ip address with x.x.x.x because a public IP was shown there.

raskin · 01-10-2007, 01:33 AM

Then which of two src's and which of two destinations do you need?

globemast · 01-11-2007, 01:19 AM

The two first src and dest are needed.

raskin · 01-11-2007, 01:56 AM

head=${LINE%% srckey=*}
mid=${head##*stream_timeout=}
mid=${mid#* }
SRC=${mid% dst=*}
DEST=${mid#* }
SRC=${SRC#src=}
DEST=${DEST#dst=}