I'm running FreeBSD and have PF firewall set up and this is command i use to display daily number of firewall hits (blocked traffic)

sudo tcpdump -n -e -tttt -r /var/log/pflog | grep $(date +%Y-%m-%d)|wc -l|sed 's/ *//' >> /home/pentago/www/pf.txt

That displays number, say 95.

I want to process pf.txt file in a way that each line has the date before hit count.

For example:

  • 01-01-2014 - 95
  • 02-01-2014 - 98
  • 03-01-2014 - 113
  • 04-01-2014 - 92


Simply put, I need sed/awk to prepend the date to each new line of the file. Does that sound reasonable?

  • I guess 'I want to..' is pretty much self explanatory. – dzhi Jan 8 '14 at 10:21
DATE=$(date +%Y-%m-%d)
HITS=$(sudo tcpdump -n -e -tttt -r /var/log/pflog | grep -c $DATE)
echo "$DATE - $HITS" >> /home/pentago/www/pf.txt
| improve this answer | |
  • Great, i modified it a little bit to include the date command and delete some whitespace with sed: DATE=$(date +%Y-%m-%d); HITS=$(sudo tcpdump -n -e -tttt -r /var/log/pflog | grep $DATE | wc -l | sed 's/ *//'); echo "$DATE - $HITS" – dzhi Jan 8 '14 at 10:52
  • 1
    @purpler To count matching lines, just use grep -c instead of piping grep to wc and cleaning up the whitespace. – Gilles 'SO- stop being evil' Jan 8 '14 at 23:37
  • You're right, it's far more convenient instead of using wc and sed. I've learned something new today. Thanks a ton! – dzhi Jan 10 '14 at 7:57
  • @Gilles Very true. I just haven't managed to fix my finger macros yet... – Jenny D Jan 10 '14 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.