I try to parse this line with vsftpd:

Sun Apr 7 07:23:33 2013 [pid 23590] [cam02430] OK UPLOAD: Client "", "/20130407/07/20130407_072324D.avi", 496846 bytes, 383.38Kbyte/sec


cut -d" " -f9 | sed 's/\[\(.*\)\]/\1/'

This parses out the username successfully which is: cam02430

But now the date has changed:

Wed Apr 10 10:37:50 2013 [pid 26137] [cam02299] OK UPLOAD: Client "", "/20130410/10/20130410_103802D.avi", 496838 bytes, 363.67Kbyte/sec

Now to parse this I have to use:

cut -d" " -f8 | sed 's/\[\(.*\)\]/\1/'

Is there a better way to parse the username in one line? I'd like to stick to a shell script.


My first instinct is to isolate the user portion (using grep -o). The good thing about it is that it has some (relatively) unique marking - the brackets.

So, the grep below isolates the (two) fields that have brackets around them, then takes out the first field (process ID) then strips the bracket off of what's left (user field)

 < vsftp.log grep -o '\[[^]]*\] *\[[^]]*\]' | sed -e 's/\[[^]]*\] *//' -e 's/\[\(.*\)\]/\1/'

If you can guarantee there are no spaces in the user name, you can take advantage and simplify things a bit. Find the bracketed field without spaces (the pid field would have them) and then do the trim.

< vsftp.log grep -o '\[[^] ]*\]' | sed -e 's/\[\(.*\)\]/\1/'

It works, though may not be optimal.

  • I can guarantee the usernames have no spaces. Thanks. – Tom Apr 10 '13 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.