With grep we found out how we could pull just the matching lines from a file. All we care about is the IP addresses used to log into symkat, though. We have a lot of information we don’t need and it’s making our eyes glaze over.
One trick we can do with awk is to show only the columns of information we want to know. In this case it’s the 8th column.
Awk expects to be given a pattern to match and an action and that’s exactly what we gave it. To understand how this works we have to understand a few key points about awk:
- Awk expects to be given a pattern to match and an action to run on input
- Awk assigns $1, $2, $3, and so on to correlate to the values of the input, split by white space. $1 = symkat.com in this example. $2 = sshd:
We did not include a pattern. As such, awk will match on all lines. The action we took was to print the eighth column.
It is worth noting that if I wanted additional information, such as both the username and the IP address a concatenation operator is not needed, the assumption is quoted text is literal (for instance, this quoting of a space between $6th value (username) and $8th value (IP Address):