Search for string in hex dumps

Question

Oracle's JDBC driver has a new feature in 11.2 whereby it can log all network packets, but in the log file each packet appears as a separate hex dump, in this format:

 Oct 23, 2013 9:14:46 AM oracle.net.ns.Packet receive
 TRACE_20: 11EEA7F0 Debug: type=6, length=1410, flags=0
 65 20 43 6F 72 70 6F 72     |e.Corpor|
 6F 6E 2E 20 43 6F 70 79     |on..Copy|
 72 69 67 68 74 20 32 30     |right.20|
 30 33 20 4F 72 61 63 6C     |03.Oracl|
 01 00 01 03                 |....    |

How can I search the log file for strings, since they may span multiple lines in the log file?

Before you go down this rabbit hole, check that you don't simply have another instance of your application running, or someone else connecting to the database, and making changes to the data at the same time! That was what was happening in my case. — Robin Green, Nov 12 '13 at 10:00

score 0 · Accepted Answer · answered Oct 23 '13 at 10:09

sed -e :a -e '$!N;s/\n [0-9A-F][0-9A-F] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ]     |\([^|]\+\)|/\1/;ta' -e 'P;D' logfile

on Linux will convert the hex dumps in logfile into strings (with control characters and spaces kept as periods), leaving other lines intact. So you can just redirect this to a file or pipe it into your favourite pager, e.g. less. You might need to take account of the fact that control characters and spaces are shown as periods when searching for multiple word strings.

With non-GNU sed it might be necessary to change \+ into *.

Search for string in hex dumps

1 Answers1