# Find keywords in multiple log files

**URL:** <https://community.unix.com/t/find-keywords-in-multiple-log-files/360691>\
**Category:** UNIX for Dummies Questions & Answers\
**Created:** [May 31, 2016, 9:59am UTC](https://community.unix.com/t/find-keywords-in-multiple-log-files/360691 "2016-05-31T09:59:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dellanicholson](https://community.unix.com/letter_avatar/dellanicholson/32/5_5575768a8748004e209b776fc1b2916d.png) [@dellanicholson](https://community.unix.com/u/dellanicholson)\
**Post date:** [May 31, 2016, 9:59am UTC](https://community.unix.com/t/find-keywords-in-multiple-log-files/360691/1 "2016-05-31T09:59:17Z")

</div>

The Problem that I am having is when the code ran and populated the progflag.csv file, columns MEMSIZE, SECOND and SASEXE were blank. The next problems are the IF else statement isn't working and the email function isn't sending the progflag.csv attachment.

a. What I want the program to do is to only read in all files that have a  
.log. extension. There other files in the same directory with different extension such as .html, and .ksh,

There are four steps that occur when the program output data to progflag.csv (data comes from multiple log files that are read in by the program):

1 for example if the following criteria in file12.log.20163005 doesn't exist, such as MEMSIZE , a directory path will the text /SASFoundation and the variable Real Time row value(Real Time 0.1) is less than 1.0, no data is outputted to progflag.csv .

1. if in file9.log.20163005, the following variables and values exist for example "MEMSIZE=200" and variable Real Time (Real Time 4.0) row value is More than 1.0, output the values and the column names to the proflag.csv.

2. if in file25.log.20163005, for example there is a directory path will text /SASFoundation and the variable Real Time (Real Time 0.2) row value is less than 1.0, output the values and its column name to the proflag.csv

An example in the progflag.csv results from the steps are as follows:

MEMSIZE SECOND SASEXE filename:  
200 4.0 file1.log.20163005  
SASFoundation file25.log.20163005

1. last, step only send an email if progflag.csv file rows are populated.

Here is the code:

```nohighlight
cd /tmp/*.log.*
awk -F '[=:;.]' '
  function pr() {if(NR>1) printf "%s\t%s\t%s\t%s\n", K[1],K[2],K[3],K[0]}
  BEGIN {
      printf "MEMSIZE\tSECOND\tSASEXE\tFilename\n"
      for(i=split("memsize ,Real Time ,SASFoundation",A,",");i;i--) L[A]=i
  }
  FNR==1 {
      pr()
       K[0]=FILENAME
      K[1]=K[2]=K[3]=x
  }
  $1 in L {v=$2;gsub("^[/]*","",v);gsub(/ *$/,"",v);K[L[$1]]=v}
  END{pr()}
if MEMSIZE OR SECOND >1.0 OR SASEXE AND Filename then
' *.log.* > progflag.csv

[-s progflag.csv] && mailx -s "subject text -a "Programs flagged" receiver@domain.com < progflag.csv
ELSE ''

```

---

<div class="post-metadata">

**Author:** ![vbe](https://community.unix.com/user_avatar/community.unix.com/vbe/32/266_2.png) [@vbe](https://community.unix.com/u/vbe)\
**Post date:** [May 31, 2016, 11:29am UTC](https://community.unix.com/t/find-keywords-in-multiple-log-files/360691/2 "2016-05-31T11:29:57Z")

</div>

Your code:

```nohighlight
if MEMSIZE OR SECOND >1.0 OR SASEXE AND Filename then
' *.log.* > progflag.csv

[-s progflag.csv] && mailx -s "subject text -a "Programs flagged" receiver@domain.com < progflag.csv
ELSE ''

```

Should not run as I see syntax errors... I am surprised you got anything as output...  
I cant guess the errors ro why its not working as the code isnt complet nor do we know what shell you are using...

```nohighlight
if MEMSIZE OR SECOND >1.0 OR SASEXE AND Filename then

```

this is notthe correct way to write an if condition statement nor is

```nohighlight
ELSE ''

```

and I suspect this is just part of issue...

---

<div class="post-metadata">

**Author:** ![dellanicholson](https://community.unix.com/letter_avatar/dellanicholson/32/5_5575768a8748004e209b776fc1b2916d.png) [@dellanicholson](https://community.unix.com/u/dellanicholson)\
**Post date:** [May 31, 2016, 5:30pm UTC](https://community.unix.com/t/find-keywords-in-multiple-log-files/360691/3 "2016-05-31T17:30:00Z")

</div>

```nohighlight
I have several problems with my program: I hope you can help me.

```

```nohighlight
1) the If else statement isn't working I am getting a syntax error.

 . The IF Else syntax is:
     If MEMSIZE OR sasfoundation (SASEXE) OR Real Time(second) >1.0 and Filename, output column name and value to csv or else nothing

```

```nohighlight
Example: output - progflag,cvs:
Memsize Second SASEXE filename                        
    400 4.0 SASFoundaion file11.log.20120314              

```

```nohighlight
2) I am not getting any data in the csv file.

```

```nohighlight
3) I am not getting the attachment in the email. I am not receiving the cvs file attachment via email

```

```nohighlight
My program read in multiple files with .log, extension. For example file12.log.20120314. The program search for 3 selected items in each log files. 2 items Memsize and SASFoundation may not be in all log files. But Real Time : and its value are in every log files.

```

```nohighlight
Item 1# input read in the program from log file: Memsize . Memsize statement stores numeric values. For example memsize=400. the program output the column name (memsize) and its value and the filename to a csv file 

```

```nohighlight
example output - progflag.csv:
memsize filename
 400 file12.log.20120314

```

```nohighlight
Item 2# the input read into the program from log files:  
Real Time: row value.  

```

```nohighlight
For example, input read from log files, 
The row value for Real Time is 4.0. Real Time : 4.0.

```

In my program Real Time is named Second.  
[/CODE]

```nohighlight
For example -input, SECOND stores 4.0. IF SECOND > 1.0 then output the column name and its value to a cvs file

```

```nohighlight
example - progflag.csv:

Second filename
 4.0 file11.log.20120314

If Real Time row value is less than 1.0 then output no data to the cvs file.

```

Example Real Time: 0.2 0.2 is less than 1.0

```nohighlight
item3#: if the program find the directory path /SASFoundation (SASEXE) then output the directory path to a cvs file

```

Example progflag.cvs  
Second SASEXE filename  
4.0 SASFoundaion file11.log.2012031  
[/CODE]

```nohighlight
cd /tmp/*.log.*
awk -F '[=:;.]' '
  function pr() {if(NR>1) printf "%s\t%s\t%s\t%s\n", K[1],K[2],K[3],K[0]}
  BEGIN {
      printf "MEMSIZE\tSECOND\tSASEXE\tFilename\n"
      for(i=split("memsize ,Real Time ,SASFoundation",A,",");i;i--) L[A]=i
  }
  FNR==1 {
      pr()
       K[0]=FILENAME
      K[1]=K[2]=K[3]=x
  }
  $1 in L {v=$2;gsub("^[/]*","",v);gsub(/ *$/,"",v);K[L[$1]]=v}
  END{pr(
{if ($1 || $2>1.0 || $ 3 && $0) printf $1 "\t" $2 "\t"" $3"\t" $0"\t; elseif($2>1.0 else print ''}'
' *.log.* > progflag.csv

[-s progflag.csv] && mailx -s "subject text -a "Programs flagged" receiver@domain.com < progflag.csv

```
