This be the latest in my problems sorting through router logs... I'm half way there on a problem, but I've hit the limitation of my knowledge
Got some router interface log files of type
router01:GigabitEthernet9/24 is up, line protocol is up (connected)
router01: 0 input errors, 0 CRC, 0 frame, 19 overrun, 0 ignored
router01:GigabitEthernet10/1 is up, line protocol is up (connected)
router01: 0 input errors, 0 CRC, 5 frame, 0 overrun, 0 ignored
router01:GigabitEthernet10/2 is up, line protocol is up (connected)
router01: 0 input errors, 0 CRC, 3 frame, 0 overrun, 0 ignored
router01:GigabitEthernet10/5 is up, line protocol is up (connected)
router01: 0 input errors, 0 CRC, 2 frame, 0 overrun, 0 ignored
router01:GigabitEthernet10/6 is up, line protocol is up (connected)
router01: 0 input errors, 0 CRC, 2 frame, 0 overrun, 0 ignored
router01:GigabitEthernet10/9 is up, line protocol is up (connected)
router01: 6297 input errors, 6297 CRC, 6298 frame, 0 overrun, 0 ignored
router01:GigabitEthernet10/10 is up, line protocol is up (connected)
router01: 0 input errors, 0 CRC, 1 frame, 0 overrun, 0 ignored
router01:GigabitEthernet10/14 is up, line protocol is up (connected)
router01: 0 input errors, 0 CRC, 1 frame, 0 overrun, 0 ignored
I don't care about frame errors or ignored errors, but I do want to take account of input errors, CRC errors and overrun errors, so I want to keep those lines (and the line above them) where those parameters are non zero, and I want to delete those lines where the important parameters are 0, and the lines above them. So... for the input above... I want the output to be
router01:GigabitEthernet9/24 is up, line protocol is up (connected)
router01: 0 input errors, 0 CRC, 0 frame, 19 overrun, 0 ignored
router01:GigabitEthernet10/9 is up, line protocol is up (connected)
router01: 6297 input errors, 6297 CRC, 6298 frame, 0 overrun, 0 ignored
I'm thinking the way to do it is to sort for lines with the string "input errors", and check if the second, or fifth, or ninth parameters are non zero, and if so keep that line and the line above it, otherwise delete the line and the line above it.
I'm doing this on ubuntu... (may or may not be relevant)