linux：使用awk，grep或sed提取特定单词

Question

希望从每一行中提取特定词

Nov  2 11:25:51 imau03ftc CSCOacs_TACACS_Accounting 0687979272 1 0 2016-11-02 11:25:51.250 +13:00 0311976914 3300 NOTICE Tacacs-Accounting: TACACS+ Accounting with Command, ACSVersion=acs-5.6.0.22-B.225, ConfigVersionId=145, Device IP Address=10.107.32.53, CmdSet=[ CmdAV=show controllers <cr> ], RequestLatency=0, Type=Accounting, Privilege-Level=15, Service=Login, User=nc-rancid, Port=tty1, Remote-Address=172.26.200.204, Authen-Method=TacacsPlus, AVPair=task_id=8280, AVPair=timezone=NZDT, AVPair=start_time=1478039151, AVPair=priv-lvl=1, AcctRequest-Flags=Stop, Service-Argument=shell, AcsSessionID=imau03ftc/262636280/336371030, SelectedAccessService=Default Device Admin, Step=13006 , Step=15008 , Step=15004 , Step=15012 , Step=13035 , NetworkDeviceName=CASWNTHS133, NetworkDeviceGroups=All Devices:All Devices, NetworkDeviceGroups=Device Type:All Device Types:Corporate, NetworkDeviceGroups=Location:All Locations, Response={Type=Accounting; AcctReply-Status=Success; }

希望提取Nov 2 11:25:51 show controllers User=nc-rancid NetworkDeviceName=CASWNTHS133可以使用awk，grep或sed

我尝试了几种组合

sudo tail -n 20 /var/log/tacacs/imau03ftc-accounting.log | grep -oP 'User=\\K.*' & 'NetworkDeviceName=\\K.*'

sudo tail -n 20 /var/log/tacacs/imau03ftc-accounting.log | sudo awk -F" " '{ print $1 " " $3 " " $9 " " $28}'

我可以再添加几行，但大多数都具有相同的格式

谢谢

Answer 1

尝试运行此命令：

sudo tail -n 20 /var/log/tacacs/imau03ftc-accounting.log > tmpfile

然后执行以下脚本：

  #!/bin/sh

   while read i
   do
     str=""
     str="$(echo $i |awk '{print $1,$2,$3}')"
     str="$str $(echo $i |awk 'match($0, /CmdAV=([^<]+)/) { print substr( $0, RSTART,RLENGTH  ) }'|awk -F "=" '{print $2}')"
     str="$str $(echo $i |awk 'match($0, /User=([^,]+)/) { print substr( $0, RSTART, RLENGTH  ) }')"
     str="$str $(echo $i |awk 'match($0, /NetworkDeviceName=([^,]+)/) { print substr( $0, RSTART, RLENGTH  ) }')"

     echo $str
  done < tmpfile

输出：

Nov 2 11:25:51 show controllers User=nc-rancid NetworkDeviceName=CASWNTHS133