>>If you posted your original input and explained what you want to do with
>>it to produce the above output, you might get a better way of extracting
>>the data, but I doubt if anyone's going to reverse engineer your script
>>because, apart from being time-consuming, they'd just reproduce any bugs
>>in your script.
> Okay, fair enough :)
> data source, /var/log/messages single line sample:
> Oct 13 07:16:34 deltree kernel: InpDrop: IN=ppp0 OUT= MAC= SRC=123.123.123.123 DST=123.123.123.123 LEN=48 TOS=0x00 PREC=0x20 TTL=126 ID=62514 DF PROTO=TCP SPT=4301 DPT=139 WINDOW=65535 RES=0x00 SYN URGP=0
> The " DF" field is not always present in log entries, thus use of '=' as
> delimiter.
> task:
> sample most recent 100 PROTO=TCP or PROTO=UDP and display as histogram
> indicator of network 'background radiation'. Perhaps present as top-like
> current, last minute, last 1/4 hour, side by side on a text web page :o)
Well, given this was your original script:
grep InpDrop: /var/log/messages \
| grep -v ICMP \
| tail -100 \
| cut -d= -f4- \
| sed 's/ DF//' \
| cut -d" " -f9,11 \
| sed 's/PROTO=//;s/\(UDP\|TCP\) DPT=\([0-9]\+\)/\2\t\1/' \
| sort -n | uniq -c > net-rad-raw
it appears that you could replace everything before the "| sort" with this:
awk -F"[ =]" '/ICMP/{next}
/InpDrop:/{n=NR%100;sub(/^.*PROTO=/,"");key[n]=$1;dpt[n]=$5}
END{for (i in dpt) print dpt[i],proto[i]}' /var/log/messages
If you're using gawk, you can do the sort within "awk" (using asort())
but that hardly seems worthwhile. If you don't care about the sort, then
you can finish it off entirely in awk:
awk -F"[ =]" '/ICMP/{next}
/InpDrop:/{sub(/^.*PROTO=/,"");key[NR%100]=$5"/"$1}
END{for (i in key)
cnt[key[i]]++
for (i in cnt) {
printf "%10s ",tolower(i)
for (j=1;j<=cnt[i];j++)
printf "*"
print ""
}
Quote:}' /var/log/messages
Regards,
Ed.
by