Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!uunet!seismo!rutgers!labrea!aurora!ames!sdcsvax!ucbvax!jade!eris!mwm
From: mwm@eris.BERKELEY.EDU (Mike (My watch has windows) Meyer)
Newsgroups: comp.unix.questions
Subject: Re: awk pattern matching
Message-ID: <4636@jade.BERKELEY.EDU>
Date: Fri, 7-Aug-87 03:40:45 EDT
Article-I.D.: jade.4636
Posted: Fri Aug  7 03:40:45 1987
Date-Received: Sat, 8-Aug-87 19:23:00 EDT
References: <1092@gilsys.UUCP>
Sender: usenet@jade.BERKELEY.EDU
Reply-To: mwm@eris.BERKELEY.EDU (Mike (My watch has windows) Meyer)
Organization: Missionaria Phonibalonica
Lines: 45
Keywords: awk, patterns, matches

In article <1092@gilsys.UUCP> mc68020@gilsys.UUCP (Thomas J Keller) writes:
<   I am attempting to write a small awk script which will scan my sulog file
<for attempts to su by any but a small list of user names.  I can't seem to get
<the thing to work.

You're using the wrong tool. This is clearly a job for sed (sounds of
phone booth being shreded, and a program coming out of it's clothes -
or something like that :-).

<   Let's say I want to output any line from the sulog that indicates that a
<user other than root, news or me attempted to su.  The format of the sulog
<records is:
<
<	SU 08/05 09:30 + tty02 msi-root
<
<    the 6th field (msi-root) is the field I want to match to.  The basic
<pattern to be matched would be any of [root, news, me] with an explicit "-"
<and then *ANY* string of chars after that.  I have tried:

How's about:

	sed -e '/mnr-/d' -e '/news-/d' -e '/me-/d' /usr/adm/sulog

That will almost certainly work, but might delete some lines it
shouldn't if the patterns match one of the first five fields.  If
you're really paranoid about wanting the sixth field, change the
patterns to look like:

	'/.* .* .* .* .* mnr-/d'

Of course, keeping the list of patters in a file is probably a win.
Better yet, try a shell script like so:

	#!/bin/sh
	sed 's;.*;/.* .* .* .* .* &-;d' < /etc/supeople |
		sed -f /dev/stdin /usr/adm/sulog

You may have to do something ugly if you don't have /dev/stdin or similar.

	<mike
--
Must have walked those streets for hours,		Mike Meyer
In the dark and in the cold,				mwm@berkeley.edu
Before I really could accept,				ucbvax!mwm
There's no place called hope road.			mwm@ucbjade.BITNET