1

I have a logfile with the following format:

Jul 13 21:47:41 192.168.100.254 "user from 192.168.100.101"

I need to remove ALL lines that contain IP's in the 192.168.x.x range but only if they appear in the 4th column.

I also need to exclude 3 IP's from the 192.168.x.x range. Lets call these

192.168.125.100
192.168.126.100
192.168.155.240 

How can I finish this command to find all the IP's in the 192.168.x.x range in the 4th column and remove all the lines except the ones that contain 192.168.125.100, 192.168.126.100, and 192.168.155.240.

awk '{print $4}' file | grep '192.168' | "remove all found except" | > save back to original file
6

Try:

awk '{f=1} $4 ~ /^192.168/{f=0} $4 ~ /192.168.(125.100|126.100|155.240)/{f=1} f' file

Example

Consider this test file:

$ cat file
Jul 13 21:47:41 192.168.100.254 "user from 192.168.100.101"
Jul 13 21:47:41 192.168.125.100 "user from 192.168.100.101"
Jul 13 21:47:41 192.168.126.100 "user from 192.168.100.101"
Jul 13 21:47:41 192.168.155.240 "user from 192.168.100.101"
Jul 13 21:47:41 123.456.789.240 "user from 192.168.100.101"

As I understand your rules, you want to keep all but the first line above.

$ awk '{f=1} $4 ~ /^192.168/{f=0} $4 ~ /192.168.(125.100|126.100|155.240)/{f=1} f' file
Jul 13 21:47:41 192.168.125.100 "user from 192.168.100.101"
Jul 13 21:47:41 192.168.126.100 "user from 192.168.100.101"
Jul 13 21:47:41 192.168.155.240 "user from 192.168.100.101"
Jul 13 21:47:41 123.456.789.240 "user from 192.168.100.101"

Multiline version

For those who prefer their code spread over multiple lines:

awk '
  {
    f=1
  }

  $4 ~ /^192.168/ {
    f=0
  }

  $4 ~ /192.168.(125.100|126.100|155.240)/ {
    f=1
  }

  f
  ' file

How it works

The code uses a single variable f. If a line should be kept, we set f=1. Otherwise, f is set to zero.

  • f=1

    To begin, assume that the line should be kept.

  • $4 ~ /^192.168/{f=0}

    If $4 starts with 192.168, then mark the line as one that we should lose.

  • $4 ~ /192.168.(125.100|126.100|155.240)/{f=1}

    For these three special cases, mark the line as a keeper: f=1.

  • f

    This is awk's cryptic shorthand for: if f is true (nonzero), then print the line.

Additional testing

As per the comments, we will try file2:

$ cat file2
Jul 13 21:47:41 192.168.100.125 "user from 192.168.100.101"
Jul 13 21:47:41 192.168.202.150 "user from 192.168.100.101"
Jul 13 21:47:41 192.168.101.45 "user from 192.168.100.101"

Now, let's run our command:

$ awk '{f=1} $4 ~ /^192.168/{f=0} $4 ~ /192.168.(125.100|126.100|155.240)/{f=1} f' file2
$ 

All these lines were removed as they should be.

  • No, I need to remove ALL the lines in the 4th column that have 192.168..x.x while only keeping the lines that have 192.168.125.100, 192.168.126.100 and, 192.168.155.240. I ran your command and although it looks to be right according to your description, It does not work. When I run it I still see lots of lines that should not be there. – user53029 Jul 13 '16 at 22:53
  • @user53029 Hmm. That is not good. Please show me a few sample lines that appear in the output but shouldn't. – John1024 Jul 13 '16 at 22:58
  • 192.168.100.125, 192.168.101.45, 192.168.202.150, etc.. – user53029 Jul 13 '16 at 22:58
  • The only lines I expect to see are 192.168.125.100, 192.168.126.100, and 192.168.155.240 – user53029 Jul 13 '16 at 23:01
  • 1
    I got it. Your command was working. Brain fart on my end. Thanks! – user53029 Jul 13 '16 at 23:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.