I asked Lars,
| > I think we need more detail as to exactly what these lines look like, what
|
| The text of the syslog message is variable. The only part of the line
| with a fixed format is the initial timestamp and hostname, from my
| original example:
|
| Feb 9 10:09:53 hostname <some sort of message text>
|
| The remained of the text is free format (but it is guaranteed to be on
| the same line).
Uh oh. MAJOR question here:
Are those angle brackets in your sample literal angle brackets, or are you
using them in your illustration to show us where the hostname ends and the
message begins (and then closing the message with another for form's sake)?
My sed script made two assumptions:
1. that the chevrons are literal;
2. that the hostname was significant, which it is not:
| It sounds as if the sed script would work just fine; I'll try it out on
| some samples and see what happens. Incidentally, I don't need a count :-).
I'm relieved that you don't need a count. However, the sed script needs
modification to ignore the hostname and to consider only the message trailer:
:0bf
| sed -e '$!N' -e '/\(<.*>\)\n.*\1/!P' -e D
That's *still* assuming that the chevrons are literal. (Since the right-side
angle bracket is anchored to the embedded newline, "[^>]*" for the text be-
tween the angle brackets wasn't needed; ".*" will do.)