SiteScope Log Monitor error message “awk: line 1: syntax error at or near”

In SiteScope (SiS) the Log Monitor using "server-side processing" could throw the error message:

ERROR – Error during log parsing: awk: line 1: syntax error at or near, awk: line 1: syntax error at or near }

The cause is the awk version.

RedHat use GNU awk (GNU Awk 3.1.7), Debian mawk (mawk 1.3.3 Nov 1996, Copyright (C) Michael D. Brennan).

The Debian’s awk does not support 3th argument for match function.

SiteScope is not checking what it needs to execute the command correctly, and there is no adaption depending of the used awk version on the remote system.

To check the AWK version execute “awk –W version”.

To install the gawk on Debian like systems use “apt-get install gawk”.

To test manually the issue use the command:

tail -c +1 <PATH + LOG FILE> |

awk ‘BEGIN{sismatches=0; if("") { RS ="" }} \

{ if((regexp && match($0, "123",groups)) ||

(!regexp && index($0, "123"))) {sismatches=sismatches+1; print "sis-matches"; \

i=0; while("true") { if (i in groups) { print "sis-match-group"; print groups[i]; i=i+1 } else {break}}}} END {if(sismatches == 0) {print "sis-no-matches-found"}}’ regexp=;

On success the message will be : “sis-no-matches-found”.

Otherwise the message will be like “syntax error at or near”.

Leave a Comment