selective printing of lines

#1 08-15-2008, 10:47 AM

Greets all, I have the following output in a file and I need an awk or
sed script to look at this format, find out if SNMP is open, then
report the host back a-la

awk '/open/{print x};{x=$0}' filename

However, this would print:
PORT STATE SERVICE

I need to go up three lines... Anyone?

Host 10.10.11.2 is running
Solaris 5.8 production
PORT STATE SERVICE
161/udp open|filtered snmp

Host 10.10.11.3 is running
Linux 2.4 kernel production
PORT STATE SERVICE
161/udp closed snmp

Host 10.10.11.4 is running
Solaris 5.9 production
PORT STATE SERVICE
161/udp open|filtered snmp

Host 10.10.11.5 is running
FreeBSD 6.0 kernel production
PORT STATE SERVICE
161/udp closed snmp

#2 08-15-2008, 10:59 AM

In article <422bb1e3-f181-4733-bdcf-ec6116e38ddc@l64g2000hse.googlegroups.com>,
sil <dsphunxion@gmail.com> wrote:
>Greets all, I have the following output in a file and I need an awk or
>sed script to look at this format, find out if SNMP is open, then
>report the host back a-la
>
>awk '/open/{print x};{x=$0}' filename
>
>However, this would print:
>PORT STATE SERVICE
>
>I need to go up three lines... Anyone?
>
>
>Host 10.10.11.2 is running
>Solaris 5.8 production
>PORT STATE SERVICE
>161/udp open|filtered snmp

How about:

/^Host/ { host = $0 } # Or maybe $2 (for just the hostname/IP)
/open/ { print host }

#3 08-15-2008, 02:34 PM

sil wrote:
> Greets all, I have the following output in a file and I need an awk or
> sed script to look at this format, find out if SNMP is open, then
> report the host back a-la
>
> awk '/open/{print x};{x=$0}' filename
>
> However, this would print:
> PORT STATE SERVICE
>
> I need to go up three lines... Anyone?

The following program will print the complete first line of every
data block that has the open word in the forth line of the block...

BEGIN {RS=""; FS="\n"} $4 ~ / open/ {print $1}

In case you just want the IP number you may use, e.g., split() to
extract the address part.

Janis

>
>
> Host 10.10.11.2 is running
> Solaris 5.8 production
> PORT STATE SERVICE
> 161/udp open|filtered snmp
>
> Host 10.10.11.3 is running
> Linux 2.4 kernel production
> PORT STATE SERVICE
> 161/udp closed snmp
>
> Host 10.10.11.4 is running
> Solaris 5.9 production
> PORT STATE SERVICE
> 161/udp open|filtered snmp
>
> Host 10.10.11.5 is running
> FreeBSD 6.0 kernel production
> PORT STATE SERVICE
> 161/udp closed snmp

#4 08-15-2008, 07:23 PM

On 2008-08-15, Janis Papanagnou <Janis_Papanagnou@hotmail.com> wrote:
> sil wrote:
>> Greets all, I have the following output in a file and I need an awk or
>> sed script to look at this format, find out if SNMP is open, then
>> report the host back a-la
>>
>> awk '/open/{print x};{x=$0}' filename
>>
>> However, this would print:
>> PORT STATE SERVICE
>>
>> I need to go up three lines... Anyone?
>
> The following program will print the complete first line of every
> data block that has the open word in the forth line of the block...
>
> BEGIN {RS=""; FS="\n"} $4 ~ / open/ {print $1}
>
> In case you just want the IP number you may use, e.g., split() to
> extract the address part.

Do you need to use the new line as FS?

Seems to me that you could just put a test
in for $NR = snmp and if true print $2.

being a noob I won't try producing the
full code line ;-)

>> Host 10.10.11.2 is running
>> Solaris 5.8 production
>> PORT STATE SERVICE
>> 161/udp open|filtered snmp
>>
>> Host 10.10.11.3 is running
>> Linux 2.4 kernel production
>> PORT STATE SERVICE
>> 161/udp closed snmp

jmh

#5 08-15-2008, 07:27 PM

On 2008-08-15, JMH <jmhall@apex.local.loc> wrote:
> On 2008-08-15, Janis Papanagnou <Janis_Papanagnou@hotmail.com> wrote:
>> sil wrote:
>>> Greets all, I have the following output in a file and I need an awk or
>>> sed script to look at this format, find out if SNMP is open, then
>>> report the host back a-la
>>>
>>> awk '/open/{print x};{x=$0}' filename
>>>
>>> However, this would print:
>>> PORT STATE SERVICE
>>>
>>> I need to go up three lines... Anyone?
>>
>> The following program will print the complete first line of every
>> data block that has the open word in the forth line of the block...
>>
>> BEGIN {RS=""; FS="\n"} $4 ~ / open/ {print $1}
>>
>> In case you just want the IP number you may use, e.g., split() to
>> extract the address part.
>
> Do you need to use the new line as FS?
>
> Seems to me that you could just put a test
> in for $NR = snmp and if true print $2.

oops -- maybe $NR-1 ~ / open/ ...

jmh

#6 08-15-2008, 10:13 PM

JMH wrote:
> On 2008-08-15, Janis Papanagnou <Janis_Papanagnou@hotmail.com> wrote:
>
>>sil wrote:
>>
>>>Greets all, I have the following output in a file and I need an awk or
>>>sed script to look at this format, find out if SNMP is open, then
>>>report the host back a-la
>>>
>>>awk '/open/{print x};{x=$0}' filename
>>>
>>>However, this would print:
>>>PORT STATE SERVICE
>>>
>>>I need to go up three lines... Anyone?
>>
>>The following program will print the complete first line of every
>>data block that has the open word in the forth line of the block...
>>
>> BEGIN {RS=""; FS="\n"} $4 ~ / open/ {print $1}
>>
>>In case you just want the IP number you may use, e.g., split() to
>>extract the address part.
>
>
> Do you need to use the new line as FS?

"need"? - You don't even "need" the RS; have a look at Kenny's proposal.

>
> Seems to me that you could just put a test
> in for $NR = snmp and if true print $2.

If you just want the IP number that's fine, if you want the whole line
the other solution might be advantageous.

Generally I avoid to linearize tabulateded data or line oriented formats
(as in this case) to be able to extend the logic without rewrite.

>
> being a noob I won't try producing the
> full code line ;-)
>
>
>>>Host 10.10.11.2 is running
>>>Solaris 5.8 production
>>>PORT STATE SERVICE
>>>161/udp open|filtered snmp
>>>
>>>Host 10.10.11.3 is running
>>>Linux 2.4 kernel production
>>>PORT STATE SERVICE
>>>161/udp closed snmp
>
>
> jmh
>

#7 08-16-2008, 09:31 AM

On 2008-08-16, Janis Papanagnou <Janis_Papanagnou@hotmail.com> wrote:
> JMH wrote:
>
>> Do you need to use the new line as FS?
>
> "need"? - You don't even "need" the RS; have a look at Kenny's proposal.

A bad word choice on my part. Thanks for
explaining you rationale for using the RS.

jmh

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode