4

We had a contractor in-house to help with some configuration of a product and we're trying to look through the putty logs he set up for us, but instead of using "printable output" he used "all session output" which includes every keystroke including "BS", etc. making the logs very difficult to read as he had many, many typos. ie:

[ESC]]0;root@host:~[BEL][root@host ~]# itm,cm[BS][BS][ESC][K[BS][ESC][Kcmd agent starp[BS]t

Is there some way to strip these control characters out, intelligently, so that the end result is a human readable file much like what you'd see in "printable output" format?

Thank you for the below suggestion. Our major painpoint is the [BS] control characters, which would turn this:

ls -pg[BS][BS]al P[BS]| greu[BS]p dr

into:

ls -al | grep dr

Any idea how that could be accomplished?

user162124
  • 43
  • 1
  • 5

2 Answers2

4

Enable a very large scrollback in putty, cat the log file, and copy and paste the result into a new file.

Mark Wagner
  • 18,019
  • 2
  • 32
  • 47
  • Or log the output of PuTTY while catting the file. I like it. – Andrew B Feb 27 '13 at 18:43
  • I tried using "printable logging" but that showed characters that were deleted as well. – Mark Wagner Feb 27 '13 at 18:59
  • Ah, right. Because it includes the input escapes, not just the output escapes. – Andrew B Feb 27 '13 at 19:05
  • Beautifully simple. Just wrote a quick script to cat all the logs into readable files and voila, we have a perfect set of history logs. Thank you very much for such a simple and elegant solution! – user162124 Feb 27 '13 at 21:11
1

While not perfect, this sed filter will give you a starting point.

sed -r 's/(\[[A-Z]+\]?|\]0;)//g' escapes.log > noescapes.log

If I pipe your sample through that filter, I get:

root@host:~[root@host ~]# itm,cmcmd agent starpt

A solution that relies on a command/script to parse out the actual terminal codes would be more elegant, this is more of a "quick fix".

Regex breakdown for those who are trying to learn them:

  • outer parenthesis for purposes of alternation (the | character is OR)
  • \[ and \] are escaped square brackets, so that they won't be interpreted as a character class.
  • [ ] contain a character class. [A-Z] is a class for matching any uppercase letter.
  • + indicates to match "one or more of the previous atom". The previous atom was the character class, so "one or more uppercase letters".
  • ? indicates that the previous atom is optional. In this case, the optional atom is \].
  • Combined meaning at this point: "an occurrence of one or more uppercase characters preceded by a literal [, optionally suffixed by a literal ]"
  • The | character is the start of the OR.
  • \]0; matches 'a literal ] suffixed by 0;`.

The replacement string is empty, so they get removed. /g tells sed to not stop at the first match.

Andrew B
  • 32,588
  • 12
  • 93
  • 131
  • Not sure how to add appropriate spacing in this comment section so I updated the original question. Thank you. – user162124 Feb 27 '13 at 18:11
  • I think Mark has the right approach at this point. It may seem roundabout, but it makes perfect sense. – Andrew B Feb 27 '13 at 18:47