☰

로그에서 정보 추출

tag-icon • tag-icon shell-script text-processing
로그에서 정보 추출

grep세 번째 필드인 "email sender"를 grep할 수 없습니다. 처음 두 필드 에 이 명령을 사용할 때 :

echo "TimeStamp  Email To:  Email From:" && awk '{print $1,$6}' logs

통나무:

2016-05-23 11:01:40 [1005583] 1b4ivg-004DZf-GX ** [email protected] F=<abbas@DomainName> P=<abbas@DomainName> R=dkim_lookuphost T=dkim_remote_smtp H=mx2.hotmail.com [65.54.188.72]:25 I=[IP Address]:56910 X=TLSv1.2:ECDHE-RSA-AES256-SHA384:256 CV=yes DN="/CN=*.hotmail.com": SMTP error from remote mail server after MAIL FROM:<abbas@DomainName> SIZE=275286: 550 SC-001 (BAY004-MC1F14) Unfortunately, messages from IP Address weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.
2016-05-23 11:12:53 [1015989] 1b4j6h-004GIq-Ob ** [email protected] F=<corporate-kbl@DomainName> P=<corporate-kbl@DomainName> R=lookuphost T=remote_smtp H=mx3.hotmail.com [65.55.37.120]:25 I=[IP Address]:51605 X=TLSv1.2:ECDHE-RSA-AES256-SHA384:256 CV=yes DN="/CN=*.hotmail.com": SMTP error from remote mail server after MAIL FROM:<corporate-kbl@DomainName> SIZE=17484: 550 SC-001 (COL004-MC4F44) Unfortunately, messages from IP Address weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

얻고 싶어하다:

 Timestamp:        Email To:               Email From:
 2016-05-23        [email protected]     abbas@DomainName
 2016-05-23        [email protected]       corporate-kbl@DomainName

"$7" 대신 "F=<>"에서 세 번째 필드 이메일 주소를 찾아야 합니다. 아래에 언급된 로그에서 "$7" 필드를 grep하면 수신자 주소가 제공됩니다.

 2016-05-23 10:19:03 [954152] 1b4iGS-004027-BM ** [email protected] ([email protected]) <[email protected]> F=<[email protected]> P=<[email protected]> R=lookuphost T=remote_smtp H=mx2.hotmail.com [65.55.37.120]:25 I=[136.243.219.141]:35485 X=TLSv1.2:ECDHE-RSA-AES256-SHA384:256 CV=yes DN="/CN=*.hotmail.com": SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=375119: 550 SC-001 (COL004-MC4F12) Unfortunately, messages from 136.243.219.141 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

`

답변1

무엇에 대해

  awk '{ printf "%s\t%s\t%s\n",$1,$6,substr($7,4,length($7)-4) ;} ' logs

아니면 제목으로

  awk 'BEGIN {printf "%s\t%s\t%s\n","Timestamp","email to","email from" }
             { printf "%s\t%s\t%s\n",$1,$6,substr($7,4,length($7)-4) ;} ' logs

새로운 정밀도 업데이트

awk 'NF>6 { d=6 ; while ( ! ($d ~ /^F=/ ) ) d++ ; printf "%s\t%s\t%s\n",$1,$6,substr($d,4,length($d)-4) ;} ' logs

어디

  • NF > 6필드가 6개 이상 있는지 확인하세요.
  • d=6 ; while ( ! ($d ~ /^F=/ ) ) d++필드를 스캔하고 F=해당 필드가 없으면 무한 루프가 발생한다는 점에 유의하세요.
  • substr($d,4,length($d)-4)이전과 마찬가지로 찾은 필드에서 추출합니다.

이것은

2016-05-23      [email protected]     abbas@DomainName
2016-05-23      [email protected]       corporate-kbl@DomainName
2016-05-23      [email protected]    [email protected]

관련 정보