Parsing a syslog file

[ebolisa]

ok, I don't fully understand why it won't work on Linux but adding the filter if '[audit]' in data[index]: fixed it Thank you all!

 
for index, line in enumerate(data):
     try:
         if '[audit]' in data[index]:
           res = data[index].strip().split('[audit] ')[1]
           result = literal_eval(res)
           timestamp = result['timestamp']
           user = result['user']['username']
           print(timestamp, user)
     except KeyError:
         pass

[snippsat]

It don't work because of first line in last log you posted.
Learn to take part out and test them,audi has no [] and not in same place here.

>>> data = "Oct 10 11:42:42 washup20 kernel: [    0.044121] audit: initializing netlink subsys (disabled)\n"
>>> res = data[0].strip().split('[audit] ')[1]
Traceback (most recent call last):
  File "<interactive input>", line 1, in <module>
IndexError: list index out of range

So what you have done work,or could just add:

except (KeyError, IndexError):