1

I have a file that has a repeating pattern in it. The original line is:

blahblah=xxx blahblahblah(xxx): blah=xxx blah=xxx blah=xxx blah=xxx a0=20a8c20 a1=20a8dc0 a2=20a70a0 a3=7ffcb25e7b60 items=3 ppid=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah="xxx" blah="xxx"

I need a command that will transform this line into this output (delete a0 up to ppid but do not delete ppid):

blahblah=xxx blahblahblah(xxx): blah=xxx blah=xxx blah=xxx blah=xxx ppid=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah=xxx blah="xxx" blah="xxx"

Please note that there will be a different amount of characters in between a0 and ppid.

Please explain your solution, I am just a student trying to learn

As a response to the comments:

Yeah I am doing it for a directory of files. The goal is a script that goes through these files. I tried using

sed -e 's/a0=<missing code>items=//'

but I could not figure out what should be in the missing code. The general pattern of the file is the same.

  • 2
    Did you try to solve it yourself? Do you have some specific issues with solution? Get your hands dirty (at least trying) with solution. That's the only way to learn. – rush Jun 18 at 17:34
  • Welcome to the the Unix and Linux stack exchange! Please review the Help Center to get information on how to best post to the site. Take the Tour if you are not familiar with how this site works. To get to your question, what have you tried so far and what is not working specifically? Is there a need to have this iterate over many files? Is the pattern to match the same in all files? Please edit your post to include these details. Thank you! – kemotep Jun 18 at 17:34
  • Prefix your code/data with four white spaces. Please take a look at editing-help. – Cyrus Jun 18 at 17:36
  • The linux-audit tag seemed appropriate: the a0, a1, a2, a3, items and ppid labels appear (in that very order) in a type of record in Audit logs (reference: RHEL Security Guide). Wasn't it? Note that this is relevant; e.g. may those xxx or blah expressions contain the literals a0 or ppid? – fra-san Jun 18 at 21:17
0
sed 's/a0.*ppid/ppid/g' yourFile

s means to substitute

It replaces string starting with a0 and ending with ppid with ppid

The period means any character

The asterisk means 0 or more of any character up until ppid

g means do it for the whole string

Type man sed in a terminal to learn more

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.