Question

I’m currently writing a simple .sh script to parse an Exim log file for strings matching ‘ o’ ‘. Currently, when viewing output.txt, all that is there is a 0 printed on every line(606 lines). I’m guessing my logic is wrong, as awk does not throw any errors.

Here is my code(updated for concatenation and counter issues). Edit: I’ve adopted some new code from dmckee’s answer that I’m now working with over the old code in favor of simplicity.

awk '/o'\''/ {          line = '> ';          for(i = 20; i <= 33; i++) {            line = line ' ' $i;          }          print line;     }' /var/log/exim/main.log > output.txt 

Any ideas?

EDIT: For clarity’s sake, I’m grepping for ‘o” in email addresses, because ‘ is an illegal character in email addresses(and in our databases, appears only with o’-prefixed names).

EDIT 2: As per commentary request, here is a sanitized sample of some desired output:

[xxx.xxx.xxx.xxx] kathleen.o'[e-mail] <kathleen.o'[e-mail]> routing defer (-51): retry time not reached  [xxx.xxx.xxx.xxx] julie.o'[e-mail] <julie.o'[e-mail]> routing defer (-51): retry time not reached  [xxx.xxx.xxx.xxx] james.o'[e-mail] <james.o'[e-mail]> routing defer (-51): retry time not reached  [xxx.xxx.xxx.xxx] daniel_o'[e-mail] <aniel_o'[e-mail]> routing defer (-51): retry time not reached 

The reason I’m starting at 20 in my loop is because everything before the 20th field is just standard log information that isn’t needed for my purposes here. All I need is everything from the IP and beyond for this solution(the messages for each 550 error are different for each mail server in use out there. I’m compiling a list of common ones)

Answer 1

There is no real need for the grep here. Let awk select the matching lines for you (and fixing your concatenation bug as per ΤΖΩΤΖΙΟΥ):

awk '/o'\''/ {              line = '> ';              for(i = 20; i <= 33; i++) {                line = line ' ' $i;              }              print line;         }' /var/log/exim/main.log > output.txt 

Of course, you end up needing some weird escaping if you do it at the promp like above. It is cleaner in a script…

---

Edit: On the first pass I missed the += problem…

Also assuming that the line you gave above is partial, as it has only 13ish fields (by default fields are white space delimited).