作者seedbcc (志明)
看板Linux
標題[問題] 又來請教egrep+awk 分析資料了
時間Fri May 16 22:03:02 2008
[ /var/log/sudo的內容 ]
May 15 16:10:32 Machine-LAB sudo: root : TTY=pts/0 ; PWD=/root ;
USER=root ; COMMAND=/bin/cat /etc/passwd
May 16 14:20:02 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home/kacr999 ;
USER=root ; COMMAND=/usr/sbin/userdel kacr111
May 16 16:29:55 Machine-LAB sudo: root : TTY=pts/0 ; PWD=/root ;
USER=root ; COMMAND=/bin/cat /etc/passwd
May 16 16:39:21 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home/kacr999 ;
USER=root ; COMMAND=/usr/sbin/useradd -g 1001 -d /home/kacr111 -s /bin/csh -c
Peter Liao -m kacr111
May 16 16:40:40 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home ;
USER=root ; COMMAND=/usr/sbin/useradd -g 1001 -d /home/kacr111 -s /bin/csh -c
Peter Liao -m kacr111
May 16 16:41:38 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home ;
USER=root ; COMMAND=/usr/sbin/userdel kacr111
[Script的內容] ~不知道要修改 哪裡，才能使 原始資料列 不要一起印出來
#!/bin/bash
################################################################################
# Purpose : To generate the sudo report
################################################################################
YR=`date +%Y`
PATH=$PATH:/usr/sbin:/bin
if [ ! -d /var/log/aig_maintain ] ;then
mkdir -p /var/log/aig_maintain
fi
FILE-1=/var/log/aig_maintain/sa.txt
LOG_DATE=`date '+%b %e'`
sudo_file='/var/log/sudo'
echo -e "<<< SECURITY ADMIN ACTIVITIES REPORT >>>" > $FILE-1
egrep 'useradd|userdel|usermod' /var/log/sudo|grep "^$LOG_DATE" |while read
line;do
echo -e "`echo $line |awk '"date +%Y" | getline YR; {print
$3,$2,$1,YR,$6 }'`\t`echo $line|cut -d= -f4|cut -d\; -f1`\t`echo $line|cut
-d= -f5`" >> $FILE-1
done
echo -e "<<< End of Security Admin Activities Report >>>\n" >> $FILE-1
chmod 644 $FILE-1
[script產生的結果（原始資料也一起出現)]
<<< SECURITY ADMIN ACTIVITIES REPORT >>>
May 16 14:20:02 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home/kacr999 ;
USER=root ; COMMAND=/usr/sbin/userdel kacr111
14:20:02 16 May 2008 kacr999 root /usr/sbin/userdel kacr111
May 16 16:39:21 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home/kacr999 ;
USER=root ; COMMAND=/usr/sbin/useradd -g 1001 -d /home/kacr111 -s /bin/csh -c
Peter Liao -m kacr111
16:39:21 16 May 2008 kacr999 root /usr/sbin/useradd -g 1001 -d /home/kacr111
-s /bin/csh -c Peter Liao -m kacr111
May 16 16:40:40 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home ; USER=root
; COMMAND=/usr/sbin/useradd -g 1001 -d /home/kacr111 -s /bin/csh -c Peter
Liao -m kacr111
16:40:40 16 May 2008 kacr999 root /usr/sbin/useradd -g 1001 -d /home/kacr111
-s /bin/csh -c Peter Liao -m kacr111
May 16 16:41:38 Machine-LAB sudo: kacr999 : TTY=pts/1 ; PWD=/home ; USER=root
; COMMAND=/usr/sbin/userdel kacr111
16:41:38 16 May 2008 kacr999 root /usr/sbin/userdel kacr111
<<< End of Security Admin Activities Report >>>
[實際想要的結果]
<<< SECURITY ADMIN ACTIVITIES REPORT >>>
14:20:02 16 May 2008 kacr999 root /usr/sbin/userdel kacr111
16:39:21 16 May 2008 kacr999 root /usr/sbin/useradd -g 1001 -d /home/kacr111
-s /bin/csh -c Peter Liao -m kacr111
16:40:40 16 May 2008 kacr999 root /usr/sbin/useradd -g 1001 -d /home/kacr111
-s /bin/csh -c Peter Liao -m kacr111
16:41:38 16 May 2008 kacr999 root /usr/sbin/userdel kacr111
<<< End of Security Admin Activities Report >>>
--
※ 發信站: 批踢踢實業坊(ptt.cc)
◆ From: 210.192.233.146
1F：推 x2006:grep -v -w "Machine-LAB" $FILE-1 05/17 01:32
2F：→ seedbcc:請問x2006，我是要改哪一列呢 ^^ 05/17 19:14
3F：推 x2006:最後一列 ( > /var/log/aig_maintain/final.txt ) 05/18 02:56
4F：推 x2006:沒看你的程式碼去外加的, 方法應該很多 05/18 03:00
5F：→ seedbcc:你的方式 ，只有截取出原始資料.. 但是我需要分析 05/18 08:05
6F：→ seedbcc:出 想要的結果 如：[實際想要的結果] 05/18 08:05
7F：推 x2006:script產生的結果（原始資料也一起出現) = sa.txt 05/18 18:32
8F：→ x2006:實際想要的結果 = final.txt 05/18 18:32
9F：→ x2006:grep -v -w 'Machine-LAB' sa.txt > final.txt 05/18 18:33
10F：→ seedbcc:依舊不了解 x2006 您的寫法 ^^ 05/19 20:07