#!/bin/bash
# Usage
#
# auditParse.sh < audit.csv
# This will generate the unstructured log excluding
# submit, digest, and import log action entries
#
echoMe () # echo wrapper for debugging
{
if [[ 0 == 1 ]]; then
echo "$@"
fi
}
# Get the f_* name positions for log entries
p4 logschema 6 > /dev/null 2>&1
if [ "$?" -ne 0 ]; then
echoMe "Do not have access to p4d, using predefined field indexes"
f_date=3
f_user=6
f_client=7
f_host=9
f_action=13
f_file=14
f_rev=15
else
n=0
for f in $(p4 logschema 6 | grep 'f_name'); do
if [ "$f" != '...' ] && [ "$f" != 'f_name' ]; then
echoMe "$n" "$f"
eval "$f"="$n"
n=$((n+1))
fi
done
fi
echoMe f_date "$f_date"
echoMe f_user "$f_user"
echoMe f_client "$f_client"
echoMe f_client "$f_host"
echoMe f_action "$f_action"
echoMe f_file "$f_file"
echoMe f_rev "$f_rev"
# Read one log line at a time from stdin
while read line; do
IFS=',' read -a entry <<< "$line"
case ${entry[$f_action]} in
# skip these actions
digest | import | submit)
;;
# otherwise spit out an unstructured log entry line
*)
# trim off the trailing timestamp2
fullDate=${entry[$f_date]}
entry[$f_date]=${fullDate% ${fullDate/* /}}
echoMe f_date "${entry[$f_date]}"
echoMe f_user "${entry[$f_user]}"
echoMe f_client "${entry[$f_client]}"
echoMe f_host "${entry[$f_host]}"
echoMe f_action "${entry[$f_action]}"
echoMe f_file "${entry[$f_file]}"
echoMe f_rev "${entry[$f_rev]}"
# yyyy/mm/dd hh:mm:ss user@host action file#rev
echo "${entry[$f_date]} ${entry[$f_user]}@${entry[$f_client]} ${entry[$f_host]} ${entry[$f_action]} ${entry[$f_file]}${entry[$f_rev]}"
;;
esac
done