[SOLVED] Sed script within bash script produces unexpecte EOF error

Kgeil · 05-15-2019, 06:25 AM

Hi, I have a sed script which runs just fine at the command prompt, but when I include it in a bash script, it fails with: unexpected EOF while looking for matching `"' As always, any help or suggestions are greatly appreciated. It might take me an hour or two to reply to comments, thank you.

I'm working in Ubuntu 16.04

The script will eventually change two patterns within a log line (the combined sed command is commented out). The sed line is:

Code:

sed -i -r "s#INIT\][0-9]{4}\s[A-Z][a-z]{2}\s[0-9]+#INIT]$ymdDate#g" $1

The script is as follows:

Code:

#!/bin/bash

if [ "$1" = "" ]; then
    echo "ERROR: Please enter filename '\n' Example: change-ossec-alertDate.sh myalerts.log "
else
#today= `date "+%s" | cut -c1-6`
today=$(date "+%s" | cut -c1-6)
ymdDate=$(date "%Y %b %d)

echo "today = $today"
# the first part of the sed command below (before the ";") works fine
# sed -i -r  "s#AV - Alert - \"[0-9]{6}#AV - Alert - \"$today#g;s#INIT\][0-9]{4}\s[A-Z][a-z]{2}\s[0-9]+#INIT]$ymdDate#g" $1

# the line below works at the prompt, but fails in a script
sed -i -r "s#INIT\][0-9]{4}\s[A-Z][a-z]{2}\s[0-9]+#INIT]$ymdDate#g" $1


fi

And last but not lease, here is the sample text:

Code:

AV - Alert - "1557833239" --> RID: "110021"; RL: "2"; RG: "windows,applocker,"; RC: "Applocker audit mode program would have been blocked"; USER: "None"; SRCIP: "None"; HOSTNAME: "(DC1) 10.101.4.210->WinEvtLog"; LOCATION: "(DC1) 10.101.4.210->WinEvtLog"; EVENT: "[INIT]2019 May 14 07:53:51 WinEvtLog: Microsoft-Windows-AppLocker/EXE and DLL: Warning(8003): no source: KevinAdmin: TESTDOMAIN: 2012R2-DC1.testdomain.local: %SYSTEM32%\MMC.EXE was allowed to run but would have been prevented from running if the AppLocker policy were enforced.[END]";

Thanks again,

Kevin

pan64 · 05-15-2019, 06:39 AM

Code:

ymdDate=$(date "%Y %b %d)

this line is just wrong

Kgeil · 05-15-2019, 07:04 AM

Quote:

Originally Posted by pan64

Code:

ymdDate=$(date "%Y %b %d)

this line is just wrong

If you could share why you make that statement, I would appreciate it.

Thanks

berndbausch · 05-15-2019, 07:39 AM

Quote:

Originally Posted by Kgeil

If you could share why you make that statement, I would appreciate it.

The line has an unbalanced quote character.

After adding the missing second quote, your EOF error will turn in an error issued by the date command. What precise error will be issued probably depends on where you will put your second quote. You may want to re-read the manual page for date.

pan64 · 05-15-2019, 08:31 AM

I suggest you to use shellcheck.net to check your script. That will help you to solve your issues (except the date format - see man date).

Kgeil · 05-15-2019, 08:55 AM

Thanks for the great advice from both of you! shellcheck.net is totally awesome. Of course, my date formatting was an issue, but my biggest issue was not really thinking through what the EOF error was telling me. I was focused on the wrong line of code the whole time...

Thanks again,
Kevin

My new script is below. Advice is still appreciated, but it does work as intended.

Code:

#!/bin/bash

if [ "$1" = "" ]; then
    printf 'ERROR: Please enter filename \n Example: change-ossec-alertDate.sh myalerts.log '
else

today=$(date "+%s" | cut -c1-6)
ymdDate=$(date '+%Y %b %d')

echo "ymdDate = $ymdDate"

echo "today = $today"

sed -i -r  "s#AV - Alert - "[0-9]{6}#AV - Alert - "$today#g;s#INIT\][0-9]{4}\s[A-Z][a-z]{2}\s[0-9]+#INIT]$ymdDate#g" "$1"



fi

Turbocapitalist · 05-15-2019, 08:59 AM

You can try adding the following as the second line of the script:

Code:

set -x

That will give you a preview of each line exactly as the script plans to execute. Then you can see how what it actually produces diverges from what you expected it to do.

Kgeil · 05-15-2019, 09:34 AM

Quote:

Originally Posted by Turbocapitalist

You can try adding the following as the second line of the script:

Code:

set -x

That will give you a preview of each line exactly as the script plans to execute. Then you can see how what it actually produces diverges from what you expected it to do.

Thanks. That's another awesome debugging tool!

chrism01 · 05-16-2019, 12:41 AM

I usually use 'set -xv'

YMMV