Hi, I want to write a shell script on Solaris 9 box to scan a log file and obtain the user login attempt details. In short can any one help on writing a shell script by which I could scan through a Log files and grep for a particular string say "AuthAttempt" and then obtain the suer details related to that. Usually the string looks like following in the logs : AuthAccept smps-uat [15/Apr/2009:12:12:20 1000] " CN=n071143,OU=Non User Accounts,OU=Administration,DC=testcore,DC =test,DC=dir,DC=telstra,DC=com" "nus740pf- app get /SiebelC Where CN=n071143 is the user. How do i obtain this value of user. The fixed string in the logs is AuthAttempt but the suer keeps on changing. Any help please.

Apologies for the typo its not "suer" its "user" in the above post. Thanks!!

use nawk on Solaris # awk '/AuthAccept/&&/CN=/{sub(/.*CN=/,"");sub(/,.*/,"");print }' file n071143 Unix Win32 tools | Gawk for Windows