Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I try to parse this line with vsftpd:

Sun Apr 7 07:23:33 2013 [pid 23590] [cam02430] OK UPLOAD: Client "", "/20130407/07/20130407_072324D.avi", 496846 bytes, 383.38Kbyte/sec


cut -d" " -f9 | sed 's/\[\(.*\)\]/\1/'

This parses out the username successfully which is: cam02430

But now the date has changed:

Wed Apr 10 10:37:50 2013 [pid 26137] [cam02299] OK UPLOAD: Client "", "/20130410/10/20130410_103802D.avi", 496838 bytes, 363.67Kbyte/sec

Now to parse this I have to use:

cut -d" " -f8 | sed 's/\[\(.*\)\]/\1/'

Is there a better way to parse the username in one line? I'd like to stick to a shell script.

share|improve this question
up vote 1 down vote accepted

My first instinct is to isolate the user portion (using grep -o). The good thing about it is that it has some (relatively) unique marking - the brackets.

So, the grep below isolates the (two) fields that have brackets around them, then takes out the first field (process ID) then strips the bracket off of what's left (user field)

 < vsftp.log grep -o '\[[^]]*\] *\[[^]]*\]' | sed -e 's/\[[^]]*\] *//' -e 's/\[\(.*\)\]/\1/'

If you can guarantee there are no spaces in the user name, you can take advantage and simplify things a bit. Find the bracketed field without spaces (the pid field would have them) and then do the trim.

< vsftp.log grep -o '\[[^] ]*\]' | sed -e 's/\[\(.*\)\]/\1/'

It works, though may not be optimal.

share|improve this answer
I can guarantee the usernames have no spaces. Thanks. – Tom Apr 10 '13 at 18:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.