Changing field X in file

/etc/newsyslog.conf on a Mac OSX system contains:

# configuration file for newsyslog
# $FreeBSD: /repoman/r/ncvs/src/etc/newsyslog.conf,v 1.50 2005/03/02 00:40:55 brooks Exp $
#
# Entries which do not specify the '/pid_file' field will cause the
# syslogd process to be signalled when that log file is rotated.  This
# action is only appropriate for log files which are written to by the
# syslogd process (ie, files listed in /etc/syslog.conf).  If there
# is no process which needs to be signalled when a given log file is
# rotated, then the entry for that file should include the 'N' flag.
#
# The 'flags' field is one or more of the letters: BCGJNUWZ or a '-'.
#
# Note: some sites will want to select more restrictive protections than the
# defaults.  In particular, it may be desirable to switch many of the 644
# entries to 640 or 600.  For example, some sites will consider the
# contents of maillog, messages, and lpd-errs to be confidential.  In the
# future, these defaults may change to more conservative ones.
#
# logfilename          [owner:group]    mode count size when  flags [/pid_file] [sig_num]
flamingo:~ joliver$ cat /etc/newsyslog.conf 
# configuration file for newsyslog
# $FreeBSD: /repoman/r/ncvs/src/etc/newsyslog.conf,v 1.50 2005/03/02 00:40:55 brooks Exp $
#
# Entries which do not specify the '/pid_file' field will cause the
# syslogd process to be signalled when that log file is rotated.  This
# action is only appropriate for log files which are written to by the
# syslogd process (ie, files listed in /etc/syslog.conf).  If there
# is no process which needs to be signalled when a given log file is
# rotated, then the entry for that file should include the 'N' flag.
#
# The 'flags' field is one or more of the letters: BCGJNUWZ or a '-'.
#
# Note: some sites will want to select more restrictive protections than the
# defaults.  In particular, it may be desirable to switch many of the 644
# entries to 640 or 600.  For example, some sites will consider the
# contents of maillog, messages, and lpd-errs to be confidential.  In the
# future, these defaults may change to more conservative ones.
#
# logfilename          [owner:group]    mode count size when  flags [/pid_file] [sig_num]
/var/log/appfirewall.log		640  5     1000	*     J
/var/log/ftp.log			640  5	   1000	*     J
/var/log/hwmond.log			640  5	   1000	*     J
/var/log/install.log			640  5	   1000	*     J
/var/log/ipfw.log			640  5	   1000	*     J
/var/log/lookupd.log			640  5	   1000	*     J
/var/log/lpr.log			640  5	   1000	*     J
/var/log/mail.log			640  5	   1000	*     J
/var/log/ppp.log			640  5	   1000	*     J
/var/log/secure.log			640  5	   1000	*     J
/var/log/system.log			640  7	   *	@T00  J
/var/log/wtmp				644  3	   *	@01T05 B

I want to change the "count" and "when" fields to a given value.

I'm kind of handy with sed, but got a headache just trying to think how I'd tackle this with that tool :slight_smile: I don't know much more about awk than how to spell it, and have started doing some reading, but it's clear that'll take me a while, so I decided to cheat and ask.

I've gotten to the point of being able to write

awk '!/^#/ {print $3}' /etc/newsyslog.conf

I can't yet actually do anything with it.

FWIW, I'm looking to change $3 of each line to "13" and $5 to "%W"

awk 'BEGIN{OFS=FS;} !/^#/ {$3=13;$5="%W";}1' /etc/newsyslog.conf

Thanks, msabhi. A minor nit is that removes all of the whitespace (the original uses tabs to line everything up), which makes it a little less readable. I'm guessing that's because awk sees any whitespace as the field separator, but FS is a single whitespace character? Is there a way to preserve existing whitespace?

Also, what is the "1" at the end of the recipe for?

The "1" is a condition, which always evaluates to "true", with no action specified. The default action for a condition, if none is specified, is { print }. So it's shorthand for "print the line".

It's equivalent to:

1 { print }

or just

{ print }

since an action with no condition is always executed.