diff --git a/ufw.awk b/ufw.awk index 300ee42..ee5d670 100755 --- a/ufw.awk +++ b/ufw.awk @@ -13,25 +13,30 @@ # Give options to process only a certain number of day's log declare port_programs=$(ss -lpntu | - awk 'BEGIN {FS=":"} NR>1&&$1!~"\\["{print $2, $4} NR>1&&$1~"\\["{print $4, $8}' | + awk 'BEGIN {FS=":"} + NR>1 && $1 !~ "\\[" {print $2, $NF} # Row does NOT contains [ -> Fetch 2nd and last columns + NR>1 && $1 ~ "\\[" {print $4, $NF} # Row contains [ -> Fetch 4th and last columns + ' | awk '{ - print $1, - substr($3, + port = $1 + program = substr($3, index($3, "\"")+1, - index($3, ",")-index($3,"\"")-2) | "sort -u"}' | - awk '{ - if (port_programs[$1]==""){ - port_programs[$1]=$2 - }else{ - port_programs[$1]=port_programs[$1]","$2 + index($3, ",")-index($3,"\"")-2) + + # Add multiple programs listening on a single port as comma separated list + if (port_programs[port]==""){ + port_programs[port]=program + }else if (index(port_programs[port], program) > 0){ # Remove duplicates + next + } + else{ + port_programs[port]=port_programs[port]","program } } - END { + END { for (port in port_programs) print port, port_programs[port] - }' -) - + }') LC_ALL=C cat /var/log/ufw.log | mawk ' function GetValue(currentColumnValue, stringToSearch) {