Grepping & RegEx Patterns for Log Filtering in Linux

RegEx, or Regular Expressions, are critical in being able to parse through logs at the CLI.  Here are a few examples for different scenarios:

Line starts with….

The ^ denotes the beginning of a line.  Many logs begin with a timestamp, so if you want to filter lines for a specific date, this works.

grep '^Jul  7' /var/log/messages

Below we are filtering for a range of dates, July 5-7.

grep '^Jul  [5-7]' /var/log/messages

Tip: it’s not a bad idea to run date to confirm the system time before you start filtering for  your logs.

Line contains X in date range Y…

If you are looking to see if a message contains a group of words, no regex is needed; you can simply grep the phase in quotes.  One method would be to pipe the results we received above for the date range.

grep '^Jul  [5-7]' /var/log/messages | grep 'Starting Network Manager'

And the inverse…for a given date range, what lines do NOT include a phrase

grep '^Jul  [5-7]' /var/log/messages | grep -v 'Starting Network Manager'

Line includes an error or warning…

grep -iE 'error|warning|critical' /var/log/messages

Lines before or after a specific event…

We can use a surround search to pull events before(-B) or after(-A) the event. Below, we’ll look at 10 lines before a specific event:

grep -B 10 'Jul 7 06:24:26 centos7-2 systemd: Started Network Manager Script Dispatcher Service.' /var/log/messages

And 10 lines after would be:

grep -A 10 'Jul 7 06:24:26 centos7-2 systemd: Started Network Manager Script Dispatcher Service.' /var/log/messages

Useful links…

More usefulness to come…

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s