0
  Aug 12 01:30:26 server.example.com sshd[19486]: Failed password for root from X.X.X.X port 50528 ssh2
  Aug 12 01:30:26 server.example.com sshd[19486]: Received disconnect from X.X.X.X port 50528:11: Bye Bye [preauth]
  Aug 12 01:30:26 server.example.com sshd[19486]: Disconnected from X.X.X.X port 50528 [preauth]
  Aug 12 01:30:28 server.example.com sshd[19491]: Failed password for root from X.X.X.X port 59628 ssh2

I have a sample Linux SSH log file pulled from "/var/log/secure". I would like filter the PID (19491 and 19486 in this example). How can I achieve this using bash?

0

2 Answers 2

1

Using awk:

awk -F '[][]' '{print $2}'  /var/log/secure
  • -F '[][]' to have files separator as open and close braces
  • $2 to validate the second field.
4
  • I would like to have that as a variable since I have thousands of those PIDs in the log file Aug 13, 2020 at 18:18
  • I still get full output instead of just the PIDs Aug 13, 2020 at 18:41
  • 1
    "I would like to have that as a variable..." For future reference, so you can get the most out of SE, @BruceMalaudzi, issues like this should be in the question.
    – John1024
    Aug 13, 2020 at 20:05
  • 1
    @Siva Thanks for the advise. Your final answers has been accepted and upvoted. Works like a charm. I understand my question was bit lame. Aug 13, 2020 at 20:07
0

This is bit clumsy but I hope someone can post a shorter version: I used sed command to replace the "[" and "]" characters with empty spaces, and then used awk command to print 6th field

# cat /var/log/secure | sed 's/\[/ /g' | sed 's/\]/ /g' | awk ' {print $6}'
19486
19486
19486
19491
1
  • 1
    You have a Useless Use of cat and four processes invoked. Keeping your approach but simplifying, consider sed 's/[^[]*\[//; s/\].*//' /var/log/secure
    – John1024
    Aug 13, 2020 at 19:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .