Thursday, January 27, 2011

Egrep Regular Expression to suppress certain lines

i try to use the following command to suppress certain lines of output that contain the strings "DST=192.168.1" or "DST=192.168.2"

tail /var/log/messages | egrep -v -e 'DST=(192\.168\.1\.1)|DST=(192\.168\.2\.1)'

My Regex doesn't work, can someone provide me a working one?

  • grep -v 'DST=192\.168\.[12]\.1'
    ought to do the trick.

    Don't even need egrep.

    --edit--

    If you want to match IPs that differ in a more substantial way:

    grep -v 'DST=\(a\.b\.c\.d\|x\.y\.z\.q\)'

    You can add more IPs by adding another \| followed by the next IP.

    In this case, you might actually want to use egrep (or grep -E, same thing) so it'll look a little nicer, like so:

    grep -E -v 'DST=(a\.b\.c\.d|x\.y\.z\.q)'
    dude : Thanks that works, can you give me also an expression for two different ipadresses like 192.168.1.1 and 239.x.x.x?
    dude : Works, as a charme, i just wonder why this doesn't work proper with colortail? there some ips slips through
    mark : I haven't used colortail so I can't be certain, but perhaps it requires extra escaping of \s or the like? Do you know what regular expression engine colortail uses? (standard, extended, or pcre?)
    dude : uh sorry, i don't know. but i switched to multitail as you suggested in the other thread and it works really fine.
    From mark

0 comments:

Post a Comment