2

I'm having some issues with log files from IIS 8.5 which I want to process with AWstats. Since my IIS servers are behind a load balancer I had to add a custom logging field, X-FORWARDED-FOR. However, this ends up kinda messy in the log files:

2015-04-10 11:34:52 20000004f+OriginalIP+66.249.67.21+ HV-WEB-01 [etc]
2015-04-10 11:35:31 20000004f$OriginalIP+127.0.0.1,+136.243.19.46+ HV-WEB-01 [etc]
2015-04-10 11:35:31 20000004f$OriginalIP+127.0.0.1,+136.243.19.46+ HV-WEB-01  [etc]
2015-04-10 21:05:38 20000004f%OriginalIP+10.10.1.7,+89.221.243.229+ HV-WEB-01 [etc]
2015-04-10 21:05:38 20000004f%OriginalIP+10.10.1.7,+89.221.243.229+ HV-WEB-01 [etc]
2015-04-10 21:06:49 20000004f+OriginalIP+2.150.2.19+ HV-WEB-01 [etc]

I can't get a hold of the load balancer guys/gals right now, so for now I'd like to fix it quick/dirty by doing a search/replace which turns all these '20000000f+OriginalIP+10.20.30.40+' entries into '10.20.30.40'.

updated: apparently there were more variations than i originally thought...

2 Answers 2

2

This takes care of everything but one trailing +:

sed 's/ [^+ ]*+*\([0-9.]*\)[,+]*/ \1 /2' <<\IN
2015-04-10 11:35:31 20000004f$OriginalIP+127.0.0.1,+136.243.19.46+ HV-WEB-01 [etc]
2015-04-10 11:35:31 20000004f$OriginalIP+127.0.0.1,+136.243.19.46+ HV-WEB-01  [etc]
2015-04-10 21:05:38 20000004f%OriginalIP+10.10.1.7,+89.221.243.229+ HV-WEB-01 [etc]
2015-04-10 21:05:38 20000004f%OriginalIP+10.10.1.7,+89.221.243.229+ HV-WEB-01 [etc]
IN

It prints...

2015-04-10 11:35:31 127.0.0.1 136.243.19.46+ HV-WEB-01 [etc]
2015-04-10 11:35:31 127.0.0.1 136.243.19.46+ HV-WEB-01  [etc]
2015-04-10 21:05:38 10.10.1.7 89.221.243.229+ HV-WEB-01 [etc]
2015-04-10 21:05:38 10.10.1.7 89.221.243.229+ HV-WEB-01 [etc]

Its because the fields are strung together on the characters I want to use as delimiters. It's a little frustrating, to be honest. But easily fixed:

sed 's/ [^+ ]*+*\([0-9.]*\)[,+]*/ \1 /2;s/+ / /' <infile
1
  • Wow, Thank you so much :) But... I see I forgot to mention that in case of multiple IP's, I only need the last/public one... Apr 11, 2015 at 12:13
1

sed 's/20000000f+OriginalIP+\([0-9.]*\)+/\1/' <yourlog >newlog

assuming that yourlog is the log you want to modify. The modified log will be stored in newlog.

1
  • That worked like a charm :) Until I discovered there was a lot more variations in the log entries than I originally thought... :-/ I've updated the question to clearify the issue. Apr 11, 2015 at 8:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .