下面是我要做資料分析的檔案
May 08 19:13:13 AAA zmd: ShutdownManager (WARN): Going to sleep, waking up at
05/08/2008 18:03:13
May 08 19:23:16 AAA syslog-ng[xxxx]: STATS: dropped 0
May 08 20:23:17 AAA syslog-ng[xxxx]: STATS: dropped 0
May 08 09:31:57 AAA sshd[xxxx]: error: PAM: failure for test3 from
192.168.5.5
May 08 09:31:58 AAA sshd[xxxx]: error: PAM: failure for test3 from
192.168.5.5
May 08 19:13:13 AAA zmd: ShutdownManager (WARN): Going to sleep, waking up at
05/09/2008 18:03:13
May 09 19:23:16 AAA syslog-ng[xxx]: STATS: dropped 0
May 09 20:23:17 AAA syslog-ng[xxx]: STATS: dropped 0
May 09 09:31:57 AAA sshd[xxx]: error: PAM: failure for test3 from 192.168.5.5
May 09 09:31:58 AAA sshd[xxx]: error: PAM: failure for test3 from 192.168.5.5
May 09 09:31:59 AAA sshd[xxx]: error: PAM: failure for test5 from 192.168.5.8
xxxxxxxxxxx xxxx xxxxx
xxxx xxxx xxxx

底下是我分析檔案的截取寫法
YR=`date +%Y`
FILE3=/temp/log1.txt
LOG_DATE=`date '+%b %e'`

MSGLOG_FILE='/temp/messages'

echo -e "<<< LOGON Fail REPORT>>>\n" > $FILE3

egrep "^$LOG_DATE.*Authentication failure for" $MSGLOG_FILE |awk '{printf "%s
%s %s, %s\n",$3,$2,$1,$11}' >> $FILE3

echo -e "<<<End of Logon Fail Report>>>\n" >> $FILE3

說明MSGLOG_FILE就是上面所指要做分析的檔案

經過上面那一列分析後 得到的檔案內容如下
<<< LOGON Fail REPORT>>>
09:31:57 09 May, test3
09:31:58 09 May, test3
09:31:59 09 May, test5
<<<End of Logon Fail Report>>>

★但是，我需要在每一列增加西元年 (因為每一列要分析的內容，只有月日時間，並無西
元年）
也就是內容變成下面
<<< LOGON Fail REPORT>>>
09:31:57 09 May 2008, test3
09:31:58 09 May 2008, test3
09:31:59 09 May 2008, test5
<<<End of Logon Fail Report>>>


不知道要如何修改上面 egrep 那行

ps:我在script內　有個參數YR可以得到2008字串
　但是就是一直修改不成功　...
　
分行寫會變成如下內容~也不是我想要的
<<< LOGON Fail REPORT>>>
09:31:57 09 May
09:31:57 09 May
09:31:57 09 May
2008,
test3
test3
test5
<<<End of Logon Fail Report>>>

--
※ 發信站: 批踢踢實業坊(ptt.cc) 
◆ From: 210.192.233.192