Results 1 to 4 of 4
  1. #1
    Join Date
    Feb 2009
    Posts
    6

    Post Unanswered: How i can delete some lines of a lot of file and then join all files on one file

    Hi,
    I have a lot of files of oracle audit Like


    ora_1106335.aud ora_1323055.aud ora_1538629.aud ora_579879.aud ora_648475.aud ora_717644.aud ora_786575.aud .. etc

    And each file like ora_648493.aud have in the following information :

    Audit file /u10/ORADATA/faban9i/audit/ora_648493.aud
    Oracle9i Enterprise Edition Release 9.2.0.4.0 - Production
    With the Partitioning, Real Application Clusters, OLAP and Oracle Data Mining options
    JServer Release 9.2.0.4.0 - Production
    ORACLE_HOME = /u11/product/oracle92
    System name: OSF1
    Node name: Amadeus1
    Release: V5.1
    Version: 2650
    Machine: alpha
    Instance name: faban9i1
    Redo thread mounted by this instance: 1
    Oracle process number: 295
    Unix process pid: 648493, image: oracle@Amadeus1 (TNS V1-V3)

    Thu Feb 19 10:54:10 2009
    SESSIONID: "345266242" ENTRYID: "1" STATEMENT: "1" USERID: "AIS2" USERHOST: "1" TERMINAL: "COBRABCO" ACTION: "100" RETURNCODE: "0" COMMENT$TEXT: "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=172.20.1.242)(PORT=16 97))" OS$USERID: "AIS2" PRIV$USED: 5

    Thu Feb 19 10:54:10 2009
    SESSIONID: "345266242" ENTRYID: "1" ACTION: "101" RETURNCODE: "0" LOGOFF$PREAD: "2" LOGOFF$LREAD: "23" LOGOFF$LWRITE: "4" LOGOFF$DEAD: "0" SESSIONCPU: "0"

    Audit file /u10/ORADATA/faban9i/audit/ora_648493.aud
    Oracle9i Enterprise Edition Release 9.2.0.4.0 - Production
    With the Partitioning, Real Application Clusters, OLAP and Oracle Data Mining options
    JServer Release 9.2.0.4.0 - Production
    ORACLE_HOME = /u11/product/oracle92
    System name: OSF1
    Node name: Amadeus1
    Release: V5.1
    Version: 2650
    Machine: alpha
    Instance name: faban9i1
    Redo thread mounted by this instance: 1
    Oracle process number: 537
    Unix process pid: 648493, image: oracle@Amadeus1 (TNS V1-V3)

    Fri Feb 20 15:59:19 2009
    SESSIONID: "345472470" ENTRYID: "1" STATEMENT: "1" USERID: "AIS2" USERHOST: "1" TERMINAL: "COBRABCO" ACTION: "100" RETURNCODE: "0" COMMENT$TEXT: "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=172.20.1.242)(PORT=34 89))" OS$USERID: "AIS2" PRIV$USED: 5

    Fri Feb 20 15:59:20 2009
    SESSIONID: "345472470" ENTRYID: "1" ACTION: "101" RETURNCODE: "0" LOGOFF$PREAD: "2" LOGOFF$LREAD: "18" LOGOFF$LWRITE: "4" LOGOFF$DEAD: "0" SESSIONCPU: "3"

    I need process all files and each file delete lines and each file only must be have the following information what begin with SESSIONID: like :
    SESSIONID: "345472470" ENTRYID: "1" STATEMENT: "1" USERID: "AIS2" USERHOST: "1" TERMINAL: "COBRABCO" ACTION: "100" RETURNCODE: "0" COMMENT$TEXT: "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=172.20.1.242)(PORT=34 89))" OS$USERID: "AIS2" PRIV$USED: 5

    And then the finish the process (delete lines of each file), join all files on only one file.

    I need your help.

    Thanks.

  2. #2
    Join Date
    Jun 2007
    Location
    London
    Posts
    2,527
    Will create one file with the data you want
    Code:
    grep "^SESSIONID" ora_*.aud > MyNewFile
    Check this is ok then delete all the other files with
    Code:
    rm ora_*.aud
    But make sure you don't rename your new file to something like ora_all.aud and then delete it.

  3. #3
    Join Date
    Jan 2007
    Location
    Jena, Germany
    Posts
    2,721
    You can "join" files by just redirecting the output to MyNewFile as Mike wrote. Just use '>>' instead of '>' because the former will append to a file will the latter will truncate the file and then append.
    Knut Stolze
    IBM DB2 Analytics Accelerator
    IBM Germany Research & Development

  4. #4
    Join Date
    Feb 2009
    Posts
    6

    Post We need save the times too

    Hi, you answer is good. but we need save the times too in the same line.

    this the body of file

    oracle [Amadeus1]% cat ora_991620.aud
    Audit file /u10/ORADATA/faban9i/audit/ora_991620.aud
    Oracle9i Enterprise Edition Release 9.2.0.4.0 - Production
    With the Partitioning, Real Application Clusters, OLAP and Oracle Data Mining options
    JServer Release 9.2.0.4.0 - Production
    ORACLE_HOME = /u11/product/oracle92
    System name: OSF1
    Node name: Amadeus1
    Release: V5.1
    Version: 2650
    Machine: alpha
    Instance name: faban9i1
    Redo thread mounted by this instance: 1
    Oracle process number: 793
    Unix process pid: 991620, image: oracle@Amadeus1 (TNS V1-V3)

    Tue Feb 24 15:26:59 2009
    SESSIONID: "345939272" ENTRYID: "1" STATEMENT: "1" USERID: "SOIV27" USERHOST: "1" TERMINAL: "unknown" ACTION: "100" RETURNCODE: "0" COMMENT$TEXT: "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=172.20.1.241)(PORT=23 52))" OS$USERID: "bizet_srv" PRIV$USED: 5

    Tue Feb 24 15:26:59 2009
    SESSIONID: "345939272" ENTRYID: "1" ACTION: "101" RETURNCODE: "0" LOGOFF$PREAD: "0" LOGOFF$LREAD: "16" LOGOFF$LWRITE: "4" LOGOFF$DEAD: "0" SESSIONCPU: "3"




    We need save the both row the date + session on new file but on one only row

    Like this

    Tue Feb 24 15:26:59 2009 SESSIONID: "345939272" ENTRYID: "1" STATEMENT: "1" USERID: "SOIV27" USERHOST: "1" TERMINAL: "unknown" ACTION: "100" RETURNCODE: "0" COMMENT$TEXT: "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=172.20.1.241)(PORT=23 52))" OS$USERID: "bizet_srv" PRIV$USED: 5
    Tue Feb 24 15:26:59 2009 SESSIONID: "345939272" ENTRYID: "1" ACTION: "101" RETURNCODE: "0" LOGOFF$PREAD: "0" LOGOFF$LREAD: "16" LOGOFF$LWRITE: "4" LOGOFF$DEAD: "0" SESSIONCPU: "3"

    Thanks very thanks.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •