Piping to DO x in @con:

[vefatica]

The first below seems to work correctly; the second doesn't. What's up?

v:\> echo a^r^nb^r^nc^r^nd | do x in @con: ( echo %x )
a
b
c
d

v:\> echo a^r^nb^r^nc^r^nd | do x in @con: ( set foo=bar & echo %x )
b
c
d
ECHO is OFF

Here's another pair that makes me wonder what's going on.

v:\> echo a^r^nb^r^nc^r^nd | do x in @con: ( set foo=bar & echo %x )
b
c
d
ECHO is OFF

v:\> echo a^r^nb^r^nc^r^nd | do x in @con: ( echo %x & set foo=bar )
a
b
c
d

I can fix the bad one with more parentheses (but if I don't understand what's going on, I won't remember to do it!).

v:\> echo a^r^nb^r^nc^r^nd | (do x in @con: ( set foo=bar & echo %x ))
a
b
c
d

 

[rps]

The first below seems to work correctly; the second doesn't. What's up?

v:\> echo a^r^nb^r^nc^r^nd | do x in @con: ( echo %x )
a
b
c
d

v:\> echo a^r^nb^r^nc^r^nd | do x in @con: ( set foo=bar & echo %x )
b
c
d
ECHO is OFF

Here's another pair that makes me wonder what's going on.

v:\> echo a^r^nb^r^nc^r^nd | do x in @con: ( set foo=bar & echo %x )
b
c
d
ECHO is OFF

v:\> echo a^r^nb^r^nc^r^nd | do x in @con: ( echo %x & set foo=bar )
a
b
c
d

I can fix the bad one with more parentheses (but if I don't understand what's going on, I won't remember to do it!).

v:\> echo a^r^nb^r^nc^r^nd | (do x in @con: ( set foo=bar & echo %x ))
a
b
c
d

TCC 21.01.51 x64 Windows 10 [Version 10.0.15063]

How about using:

c:\jpsoft\tcmd21x64>echo a^r^nb^r^nc^r^nd |! do x in @con: (*set foo=bar & *echo %x)
a
b
c
d
c:\jpsoft\tcmd21x64>echo a^r^nb^r^nc^r^nd | for x in (@con:) (*set foo=bar & *echo %x)
a
b
c
d

As you know, the examples you used are starting a new TCC instances to satisfy the pipe.
Could your tcstart.btm be contributing a delay that's causing the "a" to be missed from the @con stream?
BTW. This was an interesting distraction. But, what would you actually use this for?

 

[vefatica]

But, what would you actually use this for?

Most recently, in the command below, which logs raw network captures which look like this.

20:18:16.810025 IP 222.32.3.144.48120 > 72.230.84.149.1433: tcp 0

into formatted lines and logs and displays the formatted lines. The formatted lines look like this.

10/2,20:18:16   222.32.3.144    1433    CN

The command (maybe one of the longest I have ever written) is

windump -i %1 -q -l -n ^
not src net 72.230.84.149 ^
and not src net 72.230.84.150 ^
and not arp ^
and not net 128.230 ^
and not net 10 ^
and not port 53 ^
and not icmp6 ^
and not port 67 ^
and not ip6 ^
and not icmp ^
and not port 21 ^
and not port 22 ^
and not src port 80 ^
and not src port 443 ^
and not src port 110 ^
and not src port 43 ^
and not dst portrange 65001-65010 ^
| tee /a raw%1.dat ^
| (do l in @con: ( set ip=%@word[".",0-3,%@word[2,%l]] ^
& echo %_month/%_day,%@word[".",0,%l]^^t%ip^^t%@word[".",4,%@word[" :",6,%l]]^^t%@execstr[ipc %ip] ^
| tee /a v:\intruders%1.log ))

 

[vefatica]

As to your (rps) other points, I'm pretty sure it's not a delay in TCSTART because

1. A mere additional set of parentheses fixed it (as mentioned in my first post), and
2. Since data arrives at an average rate of 3 lines/min, it is nearly always the case that there's no data to process until several seconds have elapsed.

I started this thread because, without that extra set of parentheses, the first line of data, which ALWAYS showed up in raw%1.dat NEVER appeared on the screen and was NEVER logged to intruders%1.log.

 

[rconn]

The quick answer is that it will work if you use in-process pipes (|!).

The complete answer would be several pages long, but basically you're trying to force the single-line DO into something it was never designed for. If you want to put compound statements in your DO, don't use the single-line DO.

 

[vefatica]

How do I use a multi-line DO in a string of pipes? My first attempt appears below. The DO part worked, but ended with Unknown command "enddo", and the TEE didn't work. Please tell me how to patch it up.

type all.log | ^
do x in @con:
   echo %@word[1,%x]
   echo %@word[2,%x]
enddo ^
| tee v:\trash.txt

 

[rconn]

Why (how??) are you appending a multiline DO to the TYPE?

Put it in a batch file. You can't do that from the command line.

 

[vefatica]

Why (how??) are you appending a multiline DO to the TYPE?

Put it in a batch file. You can't do that from the command line.

It is in a batch file. How do I put a multi-line DO in a pipiline?

v:\> type mldo.btm
echo a b^r^nc d | ^
do x in @con:
   echo %@word[1,%x]
   echo %@word[0,%x]
enddo ^
| tee v:\trash.txt
v:\> mldo.btm
b
a
d
c
ECHO is OFF
ECHO is OFF
TCC: V:\mldo.btm [6]  Unknown command "enddo"

v:\> type trash.txt

v:\>

 

[rconn]

You put the DO in a batch file, not everything else. (Or call the DO batch file from the batch file containing the rest.)

 

[vefatica]

You put the DO in a batch file, not everything else. (Or call the DO batch file from the batch file containing the rest.)

Do you mean

command | processline.btm | tee /a file

where processline.btm does

do x in @con:
    stuff
    more stuff
enddo

I don't recall ever piping to a BTM, but if that'll work, I'll give it a try.

And I can't use in-process pipes. The command I'm piping is WINDUMP (network capture). It's likely to run for days (the current one has been running for 37 hours). I don't want to wait to see the processed lines (or have them logged).

 

[vefatica]

That works OK ( "do x in @con: ..." in another BTM). But now I'm curious about something else. The BTM in which the piping appears (intruders2.btm) uses %1 to name the output files of two TEEs. When TASKMGR shows me the command lines of the TCCs which are running the pipes, the literal "%1" appears in those command lines. It works OK ... the output goes to intruders1.log or intruders2.log depending on the vaule of %1 ... but how? How do those piped instances of TCC know what %1 means?