title: How to parse netstat command to get the send-q number from the line
body: <p>I have this output from netstat -naputeo:</p>
  
  <pre><code>    tcp        0      0 :::44500                    :::*                        LISTEN      2000       773788772  18117/java          off (0.00/0/0)
      tcp        0      0 :::22                       :::*                        LISTEN      0          9419       4186/sshd           off (0.00/0/0)
      tcp        0      0 ::ffff:127.0.0.1:61666      ::ffff:127.0.0.1:43940      ESTABLISHED 2000       788032760  18122/java          off (0.00/0/0)
      tcp        0      0 ::ffff:192.168.1.202:56510  ::ffff:192.168.1.202:3000   ESTABLISHED 0          791652028  6804/java_ndsagent  keepalive (7185.05/0/0)
      tcp        0      0 ::ffff:192.168.1.202:56509  ::ffff:192.168.1.202:3000   TIME_WAIT   0          0          -                   timewait (41.13/0/0)
      tcp        0      0 ::ffff:192.168.1.202:56508  ::ffff:192.168.1.202:3000   TIME_WAIT   0          0          -                   timewait (21.13/0/0)
      tcp        0   4656 ::ffff:192.168.1.202:22     ::ffff:84.208.36.125:48507  ESTABLISHED 0          791474860  24141/1             on (0.19/0/0)
      tcp        0      0 ::ffff:127.0.0.1:61616      ::ffff:127.0.0.1:45121      ESTABLISHED 2000       788032761  18117/java          off (0.00/0/0)
      tcp        0      0 ::ffff:192.168.1.202:3000   ::ffff:192.168.1.202:56510  ESTABLISHED 0          791651217  8044/rmiregistry    off (0.00/0/0)
  </code></pre>
  
  <p>The Send-Q is the 3rd field, here the offender is port 22 and 4656KB.
  The problem is that i need to output that specific line and that number/port/process to an output file [only if it is above 4000, that will be sent to my inbox and alert me.</p>
  
  <p>I have seen similar answers but I can't extract the line using those suggestions. I don't know what process will be filling the Q but I know the ports. It's not just the 22 it could be more at any giving time.</p>
  
  <p>I tried: </p>
  
  <pre><code>netstat -naputeo | awk '$3 == 0 &amp;&amp; $4 ~ /[^0-9]22$/'
  </code></pre>
  
  <p>But that gives me the wrong line. [that is the :::22]</p>
  
  <pre><code>netstat -naputeo | awk '{if(($3)&gt;0) print $3;}'
  </code></pre>
  
  <p>That is all wrong because it somehow produces all the lines of that field.</p>
  
  <p>All I need is that number and line sent to a csv and that's all. I can deal with error checking later and maybe refine it.</p>
  
  <p>Any suggestions??</p>
  
  <h2><strong>Used this and it worked for now but there is room for improvement</strong></h2>
  
  <pre><code>filterQs() {
      while read recv send address pid_program; do
          ip=${address%%:*}
          port=${address##*:}
          pid=${pid_program%%/*}
          program=${pid_program#*/}
          echo "recv=${recv} send=${send} ip=${ip} port=${port} pid=${pid} program=${program}"
  
  
          if [[ ${port} -eq 35487||  ${port} -eq 65485||  ${port} -eq CalorisPort || ${port} -eq 22 ]]
                  then
                          echo "recv=${recv} send=${send} ip=${ip} port=${port} pid=${pid} program=${program}" &gt;&gt; Qmonitor.txt
  
          fi
  
  
  done &lt; &lt;(netstat -napute 2&gt;/dev/null | awk '$1 ~ /^(tcp|udp)/ &amp;&amp; ($2 &gt; 500 || $3 &gt; 500) { print $2, $3, $4, $9 }')
  
  }
  </code></pre>
  
  <p>Thanks all</p>