Can someone please explain what happens in this command: Logfile structure:
@ max=`cut -f4 -d: logfile | sort -n -r | head -1` grep "$max"$ logfile | cut -f1,3,4 -d: | sort | uniq
I can't understand how the first line is used to define a pattern for grep.
I am using ubuntu to test this.
Any link/explanation is helpful.
virtual@virtual-VirtualBox:~$ @max='cut -f4 -d: intrulog | sort -n -r | head -1' grep "$max"$ intrulog | cut -f1,3,4 -d: | sort | uniq virtual@virtual-VirtualBox:~$
As you can see, when I execute these commands, grep does not return anything. If I execute the command in the first line, I get the expected output, but in the first case, $max is not passed to grep as the correct filter pattern
virtual@virtual-VirtualBox:~$ cut -f4 -d: intrulog | sort -n -r | head -1 24 virtual@virtual-VirtualBox:~$
JUST TO HELP FUTURE VISITORS Structure of intrulog(IPsrc:IPdst:port:packets), reduced to a few lines:
192.168.164.142:18.104.22.168:8080:5 192.168.160.37:22.214.171.124:8080:13 192.168.155.47:126.96.36.199:443:24 192.168.161.92:188.8.131.52:21:24 192.168.156.77:184.108.40.206:8080:13 192.168.164.84:220.127.116.11:8080:9
The commands are expected to return the IPSrc, the port and the number of packets: