bots_user.sh

#!/bin/bash
# Code by: Jose Nelo
# April 2017
# To : CBA CBA
# Procedure to:
# Command in bash that will show all profiles meeting following criteria:
# user logged in, user changed password, user logged of within same second (all 3 actions have to be done within 1 second)
# those actions (log in, change, log off) happend one after another with no other entires in between
#
SourceLogFile=log.txt
FileOuts=bots.FileOuts
> $FileOuts
clear
echo " "
echo " "
echo " "
echo " "
while read line;
do
 date=`echo "$line" | cut -d' ' -f1-5`
 ip=`echo "$line" | cut -d'|' -f2`
 user=`echo "$line" | cut -d'|' -f3`
 event=`echo "$line" | cut -d'|' -f5`
        if [ "$event" = "user logged in" ];then
                chk1=1;
 event1=`echo "$line" | cut -d'|' -f5`
                date_aux1=`echo "$line" | cut -d' ' -f1-5`
        fi
        if [ "$event" = "user changed password" ];then
                chk2=2;
                event2=`echo "$line" | cut -d'|' -f5`
                date_aux2=`echo "$line" | cut -d' ' -f1-5`
        fi
        if [ "$event" = "user logged off" ];then
                chk3=3;
                event3=`echo "$line" | cut -d'|' -f5`
                date_aux3=`echo "$line" | cut -d' ' -f1-5`
        fi
        if [ "$chk1" = 1 ] && [ "$chk2" = 2 ] && [ "$chk3" = 3 ]; then
        event3=`echo "$line" | cut -d'|' -f5`
        date_aux3=`echo "$line" | cut -d' ' -f1-5`
        echo "Profile < $user > "
        echo "Time 1 :$date_aux1  : Event: $event1"
        echo "Time 2 :$date_aux2  : Event: $event2"
        echo "Time 3 :$date_aux3  : Event: $event3"
        echo " "
        chk1=0;chk2=0;chk3=0
        fi
done < "$SourceLogFile"