Hi,
I have a lot of files of oracle audit Like

ora_1106335.aud ora_1323055.aud ora_1538629.aud ora_579879.aud ora_648475.aud ora_717644.aud ora_786575.aud .. etc

And each file like ora_648493.aud have in the following information :

Audit file /u10/ORADATA/faban9i/audit/ora_648493.aud
Oracle9i Enterprise Edition Release 9.2.0.4.0 - Production
With the Partitioning, Real Application Clusters, OLAP and Oracle Data Mining options
JServer Release 9.2.0.4.0 - Production
ORACLE_HOME = /u11/product/oracle92
System name: OSF1
Node name: Amadeus1
Release: V5.1
Version: 2650
Machine: alpha
Instance name: faban9i1
Redo thread mounted by this instance: 1
Oracle process number: 295
Unix process pid: 648493, image: oracle@Amadeus1 (TNS V1-V3)

Thu Feb 19 10:54:10 2009
SESSIONID: "345266242" ENTRYID: "1" STATEMENT: "1" USERID: "AIS2" USERHOST: "1" TERMINAL: "COBRABCO" ACTION: "100" RETURNCODE: "0" COMMENT$TEXT: "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=172.20.1.242)(PORT=16 97))" OS$USERID: "AIS2" PRIV$USED: 5

Thu Feb 19 10:54:10 2009
SESSIONID: "345266242" ENTRYID: "1" ACTION: "101" RETURNCODE: "0" LOGOFF$PREAD: "2" LOGOFF$LREAD: "23" LOGOFF$LWRITE: "4" LOGOFF$DEAD: "0" SESSIONCPU: "0"

Audit file /u10/ORADATA/faban9i/audit/ora_648493.aud
Oracle9i Enterprise Edition Release 9.2.0.4.0 - Production
With the Partitioning, Real Application Clusters, OLAP and Oracle Data Mining options
JServer Release 9.2.0.4.0 - Production
ORACLE_HOME = /u11/product/oracle92
System name: OSF1
Node name: Amadeus1
Release: V5.1
Version: 2650
Machine: alpha
Instance name: faban9i1
Redo thread mounted by this instance: 1
Oracle process number: 537
Unix process pid: 648493, image: oracle@Amadeus1 (TNS V1-V3)

Fri Feb 20 15:59:19 2009
SESSIONID: "345472470" ENTRYID: "1" STATEMENT: "1" USERID: "AIS2" USERHOST: "1" TERMINAL: "COBRABCO" ACTION: "100" RETURNCODE: "0" COMMENT$TEXT: "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=172.20.1.242)(PORT=34 89))" OS$USERID: "AIS2" PRIV$USED: 5

Fri Feb 20 15:59:20 2009
SESSIONID: "345472470" ENTRYID: "1" ACTION: "101" RETURNCODE: "0" LOGOFF$PREAD: "2" LOGOFF$LREAD: "18" LOGOFF$LWRITE: "4" LOGOFF$DEAD: "0" SESSIONCPU: "3"

I need process all files and each file delete lines and each file only must be have the following information what begin with SESSIONID: like :
SESSIONID: "345472470" ENTRYID: "1" STATEMENT: "1" USERID: "AIS2" USERHOST: "1" TERMINAL: "COBRABCO" ACTION: "100" RETURNCODE: "0" COMMENT$TEXT: "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=172.20.1.242)(PORT=34 89))" OS$USERID: "AIS2" PRIV$USED: 5

And then the finish the process (delete lines of each file), join all files on only one file.

I need your help.

Thanks.

Will create one file with the data you want
Check this is ok then delete all the other files with
But make sure you don't rename your new file to something like ora_all.aud and then delete it.

You can "join" files by just redirecting the output to MyNewFile as Mike wrote. Just use '>>' instead of '>' because the former will append to a file will the latter will truncate the file and then append.

Hi, you answer is good. but we need save the times too in the same line.

this the body of file

oracle [Amadeus1]% cat ora_991620.aud
Audit file /u10/ORADATA/faban9i/audit/ora_991620.aud
Oracle9i Enterprise Edition Release 9.2.0.4.0 - Production
With the Partitioning, Real Application Clusters, OLAP and Oracle Data Mining options
JServer Release 9.2.0.4.0 - Production
ORACLE_HOME = /u11/product/oracle92
System name: OSF1
Node name: Amadeus1
Release: V5.1
Version: 2650
Machine: alpha
Instance name: faban9i1
Redo thread mounted by this instance: 1
Oracle process number: 793
Unix process pid: 991620, image: oracle@Amadeus1 (TNS V1-V3)

Tue Feb 24 15:26:59 2009
SESSIONID: "345939272" ENTRYID: "1" STATEMENT: "1" USERID: "SOIV27" USERHOST: "1" TERMINAL: "unknown" ACTION: "100" RETURNCODE: "0" COMMENT$TEXT: "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=172.20.1.241)(PORT=23 52))" OS$USERID: "bizet_srv" PRIV$USED: 5

Tue Feb 24 15:26:59 2009
SESSIONID: "345939272" ENTRYID: "1" ACTION: "101" RETURNCODE: "0" LOGOFF$PREAD: "0" LOGOFF$LREAD: "16" LOGOFF$LWRITE: "4" LOGOFF$DEAD: "0" SESSIONCPU: "3"




We need save the both row the date + session on new file but on one only row

Like this

Tue Feb 24 15:26:59 2009 SESSIONID: "345939272" ENTRYID: "1" STATEMENT: "1" USERID: "SOIV27" USERHOST: "1" TERMINAL: "unknown" ACTION: "100" RETURNCODE: "0" COMMENT$TEXT: "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=172.20.1.241)(PORT=23 52))" OS$USERID: "bizet_srv" PRIV$USED: 5
Tue Feb 24 15:26:59 2009 SESSIONID: "345939272" ENTRYID: "1" ACTION: "101" RETURNCODE: "0" LOGOFF$PREAD: "0" LOGOFF$LREAD: "16" LOGOFF$LWRITE: "4" LOGOFF$DEAD: "0" SESSIONCPU: "3"

Thanks very thanks.