The format of the logs is in this manner:

Junk Junk Junk : Junk Junk Junk:IP/Port Junk Junk

I want to search using the IP and the output should be only the IP/Port part of each line in that log file.

I tried out all possible combinations with grep, cut and awk and all that bash I know :D so is it possible? Or will I have to go on with some log parsing tools?

Edit: Please note that the format is not exactly the same, the position of Junk:IP/Port may change such that its not possible using awk '{print $7}'

Update: Adding a sample log

DATE NAME-FIREWALL : %RULE-NUM: Teardown TCP connection PKT-NUM for LAN1:X.X.X.X/XX to LAN2:X.X.X.X/XX duration 0:0:0 bytes XXXX TCP FINs
DATE NAME-FIREWALL : %RULE-NUM: Built inbound TCP connection PKT-NUM for LAN1:X.X.X.X/XX (X.X.X.X/XX) to LAN2:X.X.X.X/XX (X.X.X.X/XX)

And I need to search and get the IP/Port part alongside LAN2.

  • 2
    You are going to need to be a little more precise about what your input data looks like; paste a sample. – jasonwryan Sep 2 '14 at 7:35
  • 1
    Do you need just the string LAN2:X.X.X.X/XX or the IP address:port in paretheses next to it as well? – jasonwryan Sep 2 '14 at 7:48
  • @jasonwryan Just the IP/Port along the string LAN2 i.e. X.X.X.X/XX from LAN2:X.X.X.X/XX – beginer Sep 2 '14 at 7:51

What about

awk '{for(i=1;i<=NF;i++) if ( $i ~ /[^:]*:/ ) { n=split($i,A,":"); if (length(A[2]) && n==2) print A[2] ; }} ' b.txt

Edit: (with LAN)

awk '{for(i=1;i<=NF;i++) if ( $i ~ /[^:]*:/ ) { n=split($i,A,":"); if (length(A[2]) && n==2) printf "%s -- %s\n",A[1], A[2] ; }} ' b.txt
LAN1 -- X.X.X.X/XX
LAN2 -- X.X.X.X/XX
LAN1 -- X.X.X.X/XX
LAN2 -- X.X.X.X/XX
  • Gosh man how do you guys do that?? Lol just wow...Ok but that's not the full answer, but I guess I can manage the rest. You can check the comments below my question. – beginer Sep 2 '14 at 7:59
  • Hello, I've been using awk for a quater of a century, perl geek can make this code darker I guess. – Archemar Sep 2 '14 at 8:06
  • I could use your answer because the LAN1 and LAN2 had different network ids. So I could simply pipe the output to grep and get the required one. Thanks!! – beginer Sep 3 '14 at 10:41

Give a try to this one:

grep -Po 'LAN2:\K(\d{1,3}.){3}\d{1,3}/\d*' file

This looks for a block of PATTERN:ipdigits.ipdigits.ipdigits.ipdigits/digits and prints the ipdigits.ipdigits.ipdigits.ipdigits/digits part (\K "cleans" the matching). It indicates that ipdigits must have between 1 and 3 characters. More filters could be applied (to match 1 to 255).


$ cat a
Junk Junk Junk : Junk Junk LAN2: Junk Junk
Junk Junk Junk : Junk Junk LAN3: Junk Junk
$ grep -Po 'LAN2:\K(\d{1,3}.){3}\d{1,3}/\d*' a
  • eh, didnt work, I guess you didnt check the sample logs I updated. – beginer Sep 2 '14 at 8:04
  • Well it did not work because your sample log contains X instead of numbers for the IPs. How is your real input? If it does contain just Xs, do grep -Po 'LAN1:\K(\w{1,3}.){3}\w{1,3}/\w*' file, or the same with LAN2 or whatever. – fedorqui Sep 2 '14 at 8:05
  • Yes of-course the real logs do contain numbers i.e. IPs. – beginer Sep 2 '14 at 8:08
  • Then my code should make it. I tested with some IPs and it did. Let me know if it does not! – fedorqui Sep 2 '14 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.