From owner-freebsd-audit  Wed May 29 11:29:35 2002
Delivered-To: freebsd-audit@freebsd.org
Received: from rwcrmhc54.attbi.com (rwcrmhc54.attbi.com [216.148.227.87])
	by hub.freebsd.org (Postfix) with ESMTP
	id E736737B405; Wed, 29 May 2002 11:29:23 -0700 (PDT)
Received: from blossom.cjclark.org ([12.234.91.48]) by rwcrmhc54.attbi.com
          (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP
          id <20020529182923.QMVQ13253.rwcrmhc54.attbi.com@blossom.cjclark.org>;
          Wed, 29 May 2002 18:29:23 +0000
Received: (from cjc@localhost)
	by blossom.cjclark.org (8.11.6/8.11.6) id g4TITM512746;
	Wed, 29 May 2002 11:29:22 -0700 (PDT)
	(envelope-from crist.clark@attbi.com)
X-Authentication-Warning: blossom.cjclark.org: cjc set sender to crist.clark@attbi.com using -f
Date: Wed, 29 May 2002 11:29:22 -0700
From: "Crist J. Clark" <crist.clark@attbi.com>
To: Giorgos Keramidas <keramida@freebsd.org>
Cc: freebsd-audit@freebsd.org, Brian Somers <brian@freebsd.org>,
	Doug Barton <dougb@freebsd.org>,
	Gregory Neil Shapiro <gshapiro@freebsd.org>,
	Robert Watson <rwatson@freebsd.org>
Subject: Re: Removing perl traces from src/etc/periodic
Message-ID: <20020529112922.A12700@blossom.cjclark.org>
Reply-To: cjclark@alum.mit.edu
References: <20020529152010.GA13893@hades.hell.gr>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20020529152010.GA13893@hades.hell.gr>; from keramida@freebsd.org on Wed, May 29, 2002 at 06:20:10PM +0300
X-URL: http://people.freebsd.org/~cjc/
Sender: owner-freebsd-audit@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-audit.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-audit>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-audit>
X-Loop: FreeBSD.ORG

On Wed, May 29, 2002 at 06:20:10PM +0300, Giorgos Keramidas wrote:

[snip]

> Index: etc/periodic/security/550.ipfwlimit
> ===================================================================
> RCS file: /home/ncvs/src/etc/periodic/security/550.ipfwlimit,v
> retrieving revision 1.3
> diff -u -r1.3 550.ipfwlimit
> --- etc/periodic/security/550.ipfwlimit	17 May 2002 11:34:12 -0000	1.3
> +++ etc/periodic/security/550.ipfwlimit	28 May 2002 20:57:21 -0000
> @@ -45,8 +45,10 @@
>      [Yy][Ee][Ss])
>  	IPFW_LOG_LIMIT=`sysctl -n net.inet.ip.fw.verbose_limit 2> /dev/null`
>  	if [ $? -eq 0 ] && [ "${IPFW_LOG_LIMIT}" -ne 0 ]; then
> -	    ipfw -a l | grep " log " | perl -n -e \
> -		'/^\d+\s+(\d+)/; print if ($1 >= '$IPFW_LOG_LIMIT')' > ${TMP}
> +	    ipfw -a l | grep " log " | \
> +	    grep '^[[:digit:]]\+[[:space:]]\+[[:digit:]]\+' | \
> +	    awk -v limit="$IPFW_LOG_LIMIT" \
> +		'{if ($2 > limit) {print $0}}' > ${TMP}

  +	    ipfw -a l |
  +	    awk -v limit="$IPFW_LOG_LIMIT" \
  +		'/ log / && /^[[:digit:]]+[[:space:]]+[[:digit:]]+/ { \
  +		    if ($2 > limit) {print;} \
  +		}' > ${TMP}

For whatever reason, chaining grep(1)s in front of an awk(1) always
bothers me. It's easy enough to do with one awk(1).
-- 
Crist J. Clark                     |     cjclark@alum.mit.edu
                                   |     cjclark@jhu.edu
http://people.freebsd.org/~cjc/    |     cjc@freebsd.org

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-audit" in the body of the message