gawk (under Windows)

gawk (under Windows)

Post by Phil Matthew » Fri, 03 Aug 2001 02:01:00



I have several large (~100MB) log files produced daily in which I need to
find the last occurence of various items.  Once I have found the last
occurence I need to extract the log data from around 20 lines above to 20
lines below each item.  Since I am using a WinNT workstation with fairly
limited resources I am trying to find a decent (i.e. fastish) method to get
the job done and am looking at using gawk.  Is there a way of reading a file
from bottom to top, rather than top to bottom?

Any suggestions for doing this job efficiently (not necessarily using gawk)
under WinNT?

TIA
Phil

relevant e-mail replies appreciated

 
 
 

gawk (under Windows)

Post by Aleksey Cheuso » Fri, 03 Aug 2001 04:11:59



> I have several large (~100MB) log files produced daily in which I need to
> find the last occurence of various items.  Once I have found the last
> occurence I need to extract the log data from around 20 lines above to 20
> lines below each item.  Since I am using a WinNT workstation with fairly
> limited resources I am trying to find a decent (i.e. fastish) method to get
> the job done and am looking at using gawk.  Is there a way of reading a file
> from bottom to top, rather than top to bottom?

> Any suggestions for doing this job efficiently (not necessarily using gawk)
> under WinNT?

www.cygwin.com

 
 
 

gawk (under Windows)

Post by Michael Lee Yoh » Fri, 03 Aug 2001 05:47:07


Quote:> Any suggestions for doing this job efficiently (not necessarily using > gawk) under WinNT?

I guess you're looking for a problem like GNU Tail? :)

Under the Windows environment (or at least, last I checked...) Delorie's
GNU tail does not have the ability to "follow" a file (in other words,
be able to continually display information that was appended to the file).

Syntax: tail -n <number of lines from bottom> <file name>

Download DJ Delorie's "txt20b.zip" from:

ftp://gatekeeper.dec.com/pub/micro/pc/simtelnet/gnu/djgpp/v2gnu/

Inside you will find the entire GNU textutils collection compiled for Win32.
--


Software Developer, Engineering Services
Red Hat, Inc.

 
 
 

gawk (under Windows)

Post by bowma » Fri, 03 Aug 2001 12:02:07



Quote:

> Any suggestions for doing this job efficiently (not necessarily using
gawk)
> under WinNT?

My preference for the all purpose WinNT tool is ActiveState's Perl
implementation. It will do anything gawk will, and also has a lot more use
for general NT/2000 system administration.

Using Perl, you could seek to any position in the file. the problem is the
uneven line length in most logs. if you knew all the instances of interest
were in the last 20 megs, for instance, you could seek to that position and
start processing. Or, you could start at the end and work backwards in fixed
size blocks and examine each block.

 
 
 

gawk (under Windows)

Post by J.Smit » Sat, 04 Aug 2001 01:52:52


Check out www.mingw.org
They have ports of most gnu tools for Win32 on their web site, or links to
them, including (but not limited to) gawk.
 
 
 

1. rsh [server] gawk "gawk-program" fails

Hi there,

I'm trying to invoke a gawk command on host B from host A using rsh, like
this:
/usr/bin/rsh server2 /usr/bin/gawk "'{ MY_DATE = strftime(\"%d/%m/%Y\",\$1)
MY_INDEX = index(\$4, \"/\")  TCP_CODE = substr(\$4, 1, (MY_INDEX-1))  if
(!(TCP_CODE==\"NONE\" || TCP_CODE==\"TCP_DENIED\"))  print MY_DATE,
TCP_CODE, \$5, \$7, \$8  }' /var/logs/cache/access.log.0 >
/var/logs/cache/access.log.0.tmp"

When I run this command, here's what happens:
gawk: cmd. line:1: { MY_DATE = strftime("%d/%m/%Y",$1) MY_INDEX = index($4,
"/") TCP_CODE = substr($4, 1, (MY_INDEX-1)) if (!(TCP_CODE=="NONE"
|| TCP_CODE=="TCP_DENIED")) print MY_DATE, TCP_CODE, $5, $7, $8  }
gawk: cmd. line:1:                                              ^ parse
error
gawk: cmd. line:1: { MY_DATE = strftime("%d/%m/%Y",$1) MY_INDEX = index($4,
"/") TCP_CODE = substr($4, 1, (MY_INDEX-1)) if (!(TCP_CODE=="NONE"
|| TCP_CODE=="TCP_DENIED")) print MY_DATE, TCP_CODE, $5, $7, $8  }
gawk: cmd. line:1:
^ parse error
gawk: cmd. line:1: { MY_DATE = strftime("%d/%m/%Y",$1) MY_INDEX = index($4,
"/") TCP_CODE = substr($4, 1, (MY_INDEX-1)) if (!(TCP_CODE=="NONE"
|| TCP_CODE=="TCP_DENIED")) print MY_DATE, TCP_CODE, $5, $7, $8  }
gawk: cmd. line:1:
^ parse error

The first two parse errors seem to be referring to the equals signs between
MY_INDEX and index(), and between TCP_CODE and substr(). The third parse
error doesn't seem to refer to anything in the code, but always appears a
certain amount of characters after the beginning of the command.

The gawk program works when run from a shell script on server2.

I've looked in a few shell books and done a bit of searching, but I'm still
stuck... any pearls of wisdom, anyone?

Thanks in advance,
Guy.

2. Dell OptiPlex GXpro Linux problems

3. Is there a gawk version 3.0.2 problem?

4. HP DesignJet 750C + Linux

5. gawk gone sour

6. Two IP addresses and one network card

7. gawk 3.0.2 announcement

8. 14 gig hard drive

9. compile gawk-2.15.2 ?

10. determing gawk return value

11. Gawk-2.15.6 & gcc-2.70 in ELF, testing

12. why bash script stops at gawk error

13. 2nd Beta of gawk 3.1.2 available