Hi (I'm a french guy, so sorry for my english :-( )
I think I have a similar problem ....under ubuntu 9.10 and mawk 1.3.3
I write a program to check a log file (connexion POP / IMAP).
The input file was previously sort session by session (field 4, FS = :)
I found some case where my program don't detect all new/other session when I use mawk
So I decide to test my program with gawk (3.1.6) , and then it's OK
You will find below my program (only the essentiel lines), a file for testing (15 lines), and command and results for mawk and gawk
I think my program is correct, so ... May it help
-------------------------
#!awk
BEGIN {
FS=":";
savtoken="";
}
#
{
token=$4;
if (savtoken!=token)
printf ("new session %s / %s\n", savtoken, token);
else
printf ("same %s / %s\n", savtoken, token);
savtoken=token;
}
-----------------------
Feb 3 00:08:40 rppimap01 omapd[25320]:8e7205LA: Connect from 195.101.12.154:4843 to port 110
Feb 3 00:08:40 rppimap01 omapd[25320]:8e7205LA: Login from 195.101.12.154:
Feb 3 00:08:40 rppimap01 omapd[25320]:8e7205LA: Logout from 195.101.12.154:
Feb 3 00:08:40 rppimap01 omapd[25320]:8e7205LE: Connect from 81.80.79.239:16071 to port 110
Feb 3 00:08:40 rppimap01 omapd[25320]:8e7205LE: Login from 81.80.79.239:
Feb 3 00:08:41 rppimap01 omapd[25320]:8e7205LE: Logout from 81.80.79.239:
Feb 3 00:08:40 rppimap01 omapd[25320]:8e720721: Connect from 217.128.200.136:6159 to port 110
Feb 3 00:08:40 rppimap01 omapd[25320]:8e720721: Login from 217.128.200.136:
Feb 3 00:08:43 rppimap01 omapd[25320]:8e720721: Logout from 217.128.200.136:
Feb 3 00:08:14 rppimap01 omapd[25320]:8E720725: Connect from 195.101.4.227:4746 to port 110
Feb 3 00:08:14 rppimap01 omapd[25320]:8E720725: Login from 195.101.4.227:
Feb 3 00:08:14 rppimap01 omapd[25320]:8E720725: Logout from 195.101.4.227:
Feb 3 00:08:14 rppimap01 omapd[25320]:8E720728: Connect from 195.101.4.227:13246 to port 110
Feb 3 00:08:14 rppimap01 omapd[25320]:8E720728: Login from 195.101.4.227:
Feb 3 00:08:14 rppimap01 omapd[25320]:8E720728: Logout from 195.101.4.227:
--------------------------------
# only first 3 sessions found with mawk (not correct)
cat <myfile> | mawk -f <myawk_file>
new session / 8e7205LA
same 8e7205LA / 8e7205LA
same 8e7205LA / 8e7205LA
new session 8e7205LA / 8e7205LE
same 8e7205LE / 8e7205LE
same 8e7205LE / 8e7205LE
new session 8e7205LE / 8e720721
same 8e720721 / 8e720721
same 8e720721 / 8e720721
same 8e720721 / 8E720725
same 8E720725 / 8E720725
same 8E720725 / 8E720725
same 8E720725 / 8E720728
same 8E720728 / 8E720728
same 8E720728 / 8E720728
--------------------------------
# 5 sessions found with gawk (correct)
cat <myfile> | gawk -f <myawk_file>
new session / 8e7205LA
same 8e7205LA / 8e7205LA
same 8e7205LA / 8e7205LA
new session 8e7205LA / 8e7205LE
same 8e7205LE / 8e7205LE
same 8e7205LE / 8e7205LE
new session 8e7205LE / 8e720721
same 8e720721 / 8e720721
same 8e720721 / 8e720721
new session 8e720721 / 8E720725
same 8E720725 / 8E720725
same 8E720725 / 8E720725
new session 8E720725 / 8E720728
same 8E720728 / 8E720728
same 8E720728 / 8E720728
Hi (I'm a french guy, so sorry for my english :-( )
I think I have a similar problem ....under ubuntu 9.10 and mawk 1.3.3
I write a program to check a log file (connexion POP / IMAP).
The input file was previously sort session by session (field 4, FS = :)
I found some case where my program don't detect all new/other session when I use mawk
So I decide to test my program with gawk (3.1.6) , and then it's OK
You will find below my program (only the essentiel lines), a file for testing (15 lines), and command and results for mawk and gawk
I think my program is correct, so ... May it help ------- ------- ---- ------- ------- --
-------
#!awk
BEGIN {
FS=":";
savtoken="";
}
#
{
token=$4;
if (savtoken!=token)
printf ("new session %s / %s\n", savtoken, token);
else
printf ("same %s / %s\n", savtoken, token);
savtoken=token;
}
-------
Feb 3 00:08:40 rppimap01 omapd[25320] :8e7205LA: Connect from 195.101.12.154:4843 to port 110 :8e7205LA: Login from 195.101.12.154: :8e7205LA: Logout from 195.101.12.154: :8e7205LE: Connect from 81.80.79.239:16071 to port 110 :8e7205LE: Login from 81.80.79.239: :8e7205LE: Logout from 81.80.79.239: :8e720721: Connect from 217.128. 200.136: 6159 to port 110 :8e720721: Login from 217.128.200.136: :8e720721: Logout from 217.128.200.136: :8E720725: Connect from 195.101.4.227:4746 to port 110 :8E720725: Login from 195.101.4.227: :8E720725: Logout from 195.101.4.227: :8E720728: Connect from 195.101.4.227:13246 to port 110 :8E720728: Login from 195.101.4.227: :8E720728: Logout from 195.101.4.227: ------- ------- ------- ----
Feb 3 00:08:40 rppimap01 omapd[25320]
Feb 3 00:08:40 rppimap01 omapd[25320]
Feb 3 00:08:40 rppimap01 omapd[25320]
Feb 3 00:08:40 rppimap01 omapd[25320]
Feb 3 00:08:41 rppimap01 omapd[25320]
Feb 3 00:08:40 rppimap01 omapd[25320]
Feb 3 00:08:40 rppimap01 omapd[25320]
Feb 3 00:08:43 rppimap01 omapd[25320]
Feb 3 00:08:14 rppimap01 omapd[25320]
Feb 3 00:08:14 rppimap01 omapd[25320]
Feb 3 00:08:14 rppimap01 omapd[25320]
Feb 3 00:08:14 rppimap01 omapd[25320]
Feb 3 00:08:14 rppimap01 omapd[25320]
Feb 3 00:08:14 rppimap01 omapd[25320]
-------
# only first 3 sessions found with mawk (not correct)
cat <myfile> | mawk -f <myawk_file>
new session / 8e7205LA ------- ------- ------- ----
same 8e7205LA / 8e7205LA
same 8e7205LA / 8e7205LA
new session 8e7205LA / 8e7205LE
same 8e7205LE / 8e7205LE
same 8e7205LE / 8e7205LE
new session 8e7205LE / 8e720721
same 8e720721 / 8e720721
same 8e720721 / 8e720721
same 8e720721 / 8E720725
same 8E720725 / 8E720725
same 8E720725 / 8E720725
same 8E720725 / 8E720728
same 8E720728 / 8E720728
same 8E720728 / 8E720728
-------
# 5 sessions found with gawk (correct)
cat <myfile> | gawk -f <myawk_file>
new session / 8e7205LA
same 8e7205LA / 8e7205LA
same 8e7205LA / 8e7205LA
new session 8e7205LA / 8e7205LE
same 8e7205LE / 8e7205LE
same 8e7205LE / 8e7205LE
new session 8e7205LE / 8e720721
same 8e720721 / 8e720721
same 8e720721 / 8e720721
new session 8e720721 / 8E720725
same 8E720725 / 8E720725
same 8E720725 / 8E720725
new session 8E720725 / 8E720728
same 8E720728 / 8E720728
same 8E720728 / 8E720728