How to extract file name from vsftpd log with shell script?

Question

I am using vsftpd and I want to extract the file name from successful uploads. Log example:

Tue Feb  6 11:49:25 2018 [pid 13018] [xyz] OK UPLOAD: Client "1.2.3.4", "/filename.zip", 131072000 bytes, 19607.40Kbyte/sec
Tue Feb  6 11:49:25 2018 [pid 13017] [xyz] OK UPLOAD: Client "1.2.3.4", "/filename.zip", 131072000 bytes, 24426.38Kbyte/sec
Tue Feb  6 11:49:30 2018 [pid 13018] [xyz] OK UPLOAD: Client "1.2.3.4", "/filename.zip", 131072000 bytes, 25387.19Kbyte/sec

I am using this code:

#!/bin/sh

tail -F /var/log/vsftpd.log | while read line; do
  if echo "$line" | grep -q 'OK UPLOAD:'; then
    line=$(echo "$line" | tr -s " ")
    filename=$(echo "$line" | cut -d, -f2)
    echo "$filename"
  fi
done

The problem is if the file name has a comma inside, it will not work properly.

What is your expected output for the given string? – Inian Feb 06 '18 at 14:22 — Inian, Feb 06 '18 at 14:22

anubhava · Accepted Answer · 2018-02-06T14:59:53.730

2

Don't use bash commands for this, better to use this gnu awk solution with a FPAT:

tail /var/log/vsftpd.log |
awk -v FPAT='\\[[^]]*\\]|"[^"]*"' '/OK UPLOAD/{gsub(/[][]/, "", $2);
gsub(/"/, "", $4); cmd=sprintf("echo php /path/to/my/script.php \"%s\" \"%s\"", $2, $4);
cmd | getline result; close(cmd); print result}'

php /path/to/my/script.php xyz /filename.zip
php /path/to/my/script.php xyz /filename.zip
php /path/to/my/script.php xyz /filename.zip

Once you are satisfied with the output then remove echo before php.

edited Feb 06 '18 at 14:59

answered Feb 06 '18 at 14:23

anubhava

761,203
64
569
643

Thanks for your answer. Inside the loop instead of `echo` I run a php script and pass 2 variables, filename and folder (folder in this case=xyz) can you update your answer to make it work like that? My folder var assignment looks like this: `folder=$(echo "$line" | cut -d ' ' -f8)` , then I do: `php /path/to/my/script.php "$folder" "$filename"` – HTMHell Feb 06 '18 at 14:28
Yes, and run a php script for each line, with those variables passed. – HTMHell Feb 06 '18 at 14:30
It's working with commas, but if the file has the sign `&` it will stop the string. For instance, the file name "Test & Test.zip" will result "Test " – HTMHell Feb 06 '18 at 14:48
awk: cmd. line:3: (FILENAME=- FNR=1) fatal: expression for `|' redirection has null string value – HTMHell Feb 06 '18 at 14:54
1

Thank you very much, you helped me a lot! – HTMHell Feb 06 '18 at 15:03
Hey, for some reason the following line resulted `Feb` and `16:37:55` as parameters: `Wed Feb 7 16:44:15 2018 [pid 21777] [0SZZeYbW] OK UPLOAD: Client "1.2.3.4", "/new-upload-test.txt", 4 bytes, 0.01Kbyte/sec ` And in another server, almost the exact same line did work as expected: `Wed Feb 7 16:59:21 2018 [pid 9450] [0SZZeYbW] OK UPLOAD: Client "1.2.3.4", "/new-upload-test.txt", 4 bytes, 0.01Kbyte/sec` I see that the PID number lengths are different, does it matter? – HTMHell Feb 07 '18 at 15:00
As I mentioned in answer, this requires `gnu awk`. Make sure you have `gnu awk` there – anubhava Feb 07 '18 at 16:15

How to extract file name from vsftpd log with shell script?

1 Answers1