日誌顯示命令輸出操作

以下是在 macOS high sierra 上執行的命令。

**`Command`**

log show --info --predicate 'process="jamf" and eventMessage contains "Informing the JSS about login for user"' --start 2019-04-25|awk '{printf "%s %s %s %s %s %s %s %s %s %s %s %s %s \n", $1,$2,$4,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18}'|sed '1d'|column -t -s " "|grep -v "Informing  the  JSS  about  login  for  user  root"

Output:

log: warning: ./system_logs.logarchive present but reading from system log store.

2019-04-25  09:49:26.843101+0530  Default  jamf:  [com.jamf.management.binary:all]  Informing  the  JSS  about  login  for  user  swastibhushandeb
2019-04-25  20:14:47.928848+0530  Default  jamf:  [com.jamf.management.binary:all]  Informing  the  JSS  about  login  for  user  swastibhushandeb

Desired Output:

2019-04-25  09:49:26.843101+0530  Default  jamf:  [com.jamf.management.binary:all]  Local Login for user  swastibhushandeb 
2019-04-25  20:14:47.928848+0530  Default  jamf:  [com.jamf.management.binary:all]  Local Login for user  swastibhushandeb 

我知道Informing the JSS about login for user swastibhushandeb可以使用 ““替換sed 's/Informing the JSS about login for user swastibhushandeb/Local Login for user swastibhushandeb/'

1. 但是由於使用者名在不同的場景下可能不同，那麼包含使用者名的特定欄位如何"Informing the JSS about login for user swastibhushandeb"被選擇和替換呢？
2. 如何使用列標題插入到輸出中awk begin

歡迎提出改進建議/範常式式碼。

你的第一個問題的答案是：

sed 's/Informing  the  JSS  about  login  for  user/Local Login for user'

您建議了正確的命令，但無需替換username, 替換其他詞。

對於第二個問題，您應該提供更多詳細資訊。

請按照以下命令進行管道輸出

我刪除了警告行日誌：警告：並添加了您提到的標題 awk 以正確的空間格式完成的一切

命令

awk 'BEGIN{print "Date Time Type bundle Logininformation"}NR >1{gsub("Informing\t  the  JSS  about","Local",$0);print $0}' k.txt|sed '/^$/d'| awk '{printf "%30s%30s%30s%30s%30s\n",$1,$2,$3,$4,$5}'| awk '$0 !~/^$/{print $0}'

輸出

awk 'BEGIN{print "Date Time Type bundle Logininformation"}NR >1{gsub("Informing\t  the  JSS  about","Local",$0);print $0}' k.txt|sed '/^$/d'| awk '{printf "%30s%30s%30s%30s%30s\n",$1,$2,$3,$4,$5}'| awk '$0 !~/^$/{print $0}'
                         Date                          Time                          Type                        bundle              Logininformation
                   2019-04-25          09:49:26.843101+0530                       Default                         jamf:[com.jamf.management.binary:all]
                   2019-04-25          20:14:47.928848+0530                       Default                         jamf:[com.jamf.management.binary:all]

引用自：https://unix.stackexchange.com/questions/515499