Shell script for parsing log file

Question

I'm writing a shell script to parse through log file and pull out all instances where sudo succeeded and/or failed. I'm realizing now that this probably would've been easier with shell's equivalent of regex, but I didn't want to take the time to dig around (and now I'm paying the price). Anyway:

sudobool=0
sudoCount=0

for i in `cat /var/log/auth.log`;
do
    for word in $i;
    do
        if $word == "sudo:"
        then
            echo "sudo found"
            sudobool=1;
            sudoCount=`expr $sudoCount + 1`;
        fi
    done

    sudobool=0;

done


echo "There were " $sudoCount " attempts to use sudo, " $sudoFailCount " of which failed."

So, my understanding of the code I've written: read auth.log and split it up line by line, which are stored in i. Each word in i is checked to see if it is sudo:, if it is, we flip the bool and increment. Once we've finished parsing the line, reset the bool and move to the next line.

However, judging by my output, the shell is trying to execute the individual words of the log file, typically returning '$word : not found'.

wadkar · Accepted Answer · 2011-08-02 21:15:22Z

4

why don't you use grep for this?

grep sudo /var/log/auth.log

if you want a count pipe it to wc -l

grep sudo /var/log/auth.log | wc -l

or still better use -c option to grep, which prints how many lines were found containing sudo

grep -c sudo /var/log/auth.log

or maybe I am missing something simple here?
EDIT: I saw $sudoFailCount after scrolling, do you want to count how many failed attempts were made to use sudo ?? You have not defined any value for $sudoFailCount in your script, so it will print nothing. Also you are missing the test brackets [[ ]] around your if condition checking

edited Aug 2, 2011 at 21:15

answered Aug 2, 2011 at 20:26

wadkar

9602 gold badges16 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Darth_Sy Over a year ago

All great additions to my knowledge base. Thanks!

l0b0 · Accepted Answer · 2011-08-03 08:47:13Z

2

Expanding on Sudhi's answer, here's a one-liner:

$ echo "There were $(grep -c ' sudo: ' /var/log/auth.log) attempts to use sudo, $(grep -c ' sudo: .*authentication failure' /var/log/auth.log) of which failed."
There were 17 attempts to use sudo, 1 of which failed.

answered Aug 3, 2011 at 8:47

l0b0

59.6k32 gold badges155 silver badges247 bronze badges

Comments

glenn jackman · Accepted Answer · 2011-08-02 20:32:06Z

1

Your error message arises from a lack of syntax in your if statement: you need to put the condition in [[brackets]]

Using the pattern matching in bash:

#!/bin/bash
sudoCount=0
while read line; do
    sudoBool=0
    if [[ "$line" = *sudo:* ]]; then
        sudoBool=1
        (( sudoCount++ ))
        # do something with sudobool ?
    fi
done < /var/log/auth.log
echo "There were $sudoCount attempts to use sudo."

I'm not initimately familiar with the auth.log -- what is the pattern to determine success or failure?

answered Aug 2, 2011 at 20:32

glenn jackman

249k42 gold badges233 silver badges362 bronze badges

Collectives™ on Stack Overflow

Shell script for parsing log file

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related