Search for string in hex dumps

Question

Oracle's JDBC driver has a new feature in 11.2 whereby it can log all network packets, but in the log file each packet appears as a separate hex dump, in this format:

 Oct 23, 2013 9:14:46 AM oracle.net.ns.Packet receive
 TRACE_20: 11EEA7F0 Debug: type=6, length=1410, flags=0
 65 20 43 6F 72 70 6F 72     |e.Corpor|
 6F 6E 2E 20 43 6F 70 79     |on..Copy|
 72 69 67 68 74 20 32 30     |right.20|
 30 33 20 4F 72 61 63 6C     |03.Oracl|
 01 00 01 03                 |....    |

How can I search the log file for strings, since they may span multiple lines in the log file?

Answer 1

sed -e :a -e '$!N;s/\n [0-9A-F][0-9A-F] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ] [0-9A-F ][0-9A-F ]     |\([^|]\+\)|/\1/;ta' -e 'P;D' logfile

on Linux will convert the hex dumps in logfile into strings (with control characters and spaces kept as periods), leaving other lines intact. So you can just redirect this to a file or pipe it into your favourite pager, e.g. less. You might need to take account of the fact that control characters and spaces are shown as periods when searching for multiple word strings.

With non-GNU sed it might be necessary to change \+ into *.