作者seedbcc (志明)
看板Linux
标题[问题] 又来请教egrep+awk 分析资料了
时间Fri May 16 22:03:02 2008
[ /var/log/sudo的内容 ]
May 15 16:10:32 Machine-LAB sudo: root : TTY=pts/0 ; PWD=/root ;
USER=root ; COMMAND=/bin/cat /etc/passwd
May 16 14:20:02 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home/kacr999 ;
USER=root ; COMMAND=/usr/sbin/userdel kacr111
May 16 16:29:55 Machine-LAB sudo: root : TTY=pts/0 ; PWD=/root ;
USER=root ; COMMAND=/bin/cat /etc/passwd
May 16 16:39:21 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home/kacr999 ;
USER=root ; COMMAND=/usr/sbin/useradd -g 1001 -d /home/kacr111 -s /bin/csh -c
Peter Liao -m kacr111
May 16 16:40:40 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home ;
USER=root ; COMMAND=/usr/sbin/useradd -g 1001 -d /home/kacr111 -s /bin/csh -c
Peter Liao -m kacr111
May 16 16:41:38 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home ;
USER=root ; COMMAND=/usr/sbin/userdel kacr111
[Script的内容] ~不知道要修改 哪里，才能使 原始资料列 不要一起印出来
#!/bin/bash
################################################################################
# Purpose : To generate the sudo report
################################################################################
YR=`date +%Y`
PATH=$PATH:/usr/sbin:/bin
if [ ! -d /var/log/aig_maintain ] ;then
mkdir -p /var/log/aig_maintain
fi
FILE-1=/var/log/aig_maintain/sa.txt
LOG_DATE=`date '+%b %e'`
sudo_file='/var/log/sudo'
echo -e "<<< SECURITY ADMIN ACTIVITIES REPORT >>>" > $FILE-1
egrep 'useradd|userdel|usermod' /var/log/sudo|grep "^$LOG_DATE" |while read
line;do
echo -e "`echo $line |awk '"date +%Y" | getline YR; {print
$3,$2,$1,YR,$6 }'`\t`echo $line|cut -d= -f4|cut -d\; -f1`\t`echo $line|cut
-d= -f5`" >> $FILE-1
done
echo -e "<<< End of Security Admin Activities Report >>>\n" >> $FILE-1
chmod 644 $FILE-1
[script产生的结果（原始资料也一起出现)]
<<< SECURITY ADMIN ACTIVITIES REPORT >>>
May 16 14:20:02 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home/kacr999 ;
USER=root ; COMMAND=/usr/sbin/userdel kacr111
14:20:02 16 May 2008 kacr999 root /usr/sbin/userdel kacr111
May 16 16:39:21 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home/kacr999 ;
USER=root ; COMMAND=/usr/sbin/useradd -g 1001 -d /home/kacr111 -s /bin/csh -c
Peter Liao -m kacr111
16:39:21 16 May 2008 kacr999 root /usr/sbin/useradd -g 1001 -d /home/kacr111
-s /bin/csh -c Peter Liao -m kacr111
May 16 16:40:40 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home ; USER=root
; COMMAND=/usr/sbin/useradd -g 1001 -d /home/kacr111 -s /bin/csh -c Peter
Liao -m kacr111
16:40:40 16 May 2008 kacr999 root /usr/sbin/useradd -g 1001 -d /home/kacr111
-s /bin/csh -c Peter Liao -m kacr111
May 16 16:41:38 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home ; USER=root
; COMMAND=/usr/sbin/userdel kacr111
16:41:38 16 May 2008 kacr999 root /usr/sbin/userdel kacr111
<<< End of Security Admin Activities Report >>>
[实际想要的结果]
<<< SECURITY ADMIN ACTIVITIES REPORT >>>
14:20:02 16 May 2008 kacr999 root /usr/sbin/userdel kacr111
16:39:21 16 May 2008 kacr999 root /usr/sbin/useradd -g 1001 -d /home/kacr111
-s /bin/csh -c Peter Liao -m kacr111
16:40:40 16 May 2008 kacr999 root /usr/sbin/useradd -g 1001 -d /home/kacr111
-s /bin/csh -c Peter Liao -m kacr111
16:41:38 16 May 2008 kacr999 root /usr/sbin/userdel kacr111
<<< End of Security Admin Activities Report >>>
--
※ 发信站: 批踢踢实业坊(ptt.cc)
◆ From: 210.192.233.146
1F：推 x2006:grep -v -w "Machine-LAB" $FILE-1 05/17 01:32
2F：→ seedbcc:请问x2006，我是要改哪一列呢 ^^ 05/17 19:14
3F：推 x2006:最後一列 ( > /var/log/aig_maintain/final.txt ) 05/18 02:56
4F：推 x2006:没看你的程式码去外加的, 方法应该很多 05/18 03:00
5F：→ seedbcc:你的方式 ，只有截取出原始资料.. 但是我需要分析 05/18 08:05
6F：→ seedbcc:出 想要的结果 如：[实际想要的结果] 05/18 08:05
7F：推 x2006:script产生的结果（原始资料也一起出现) = sa.txt 05/18 18:32
8F：→ x2006:实际想要的结果 = final.txt 05/18 18:32
9F：→ x2006:grep -v -w 'Machine-LAB' sa.txt > final.txt 05/18 18:33
10F：→ seedbcc:依旧不了解 x2006 您的写法 ^^ 05/19 20:07