7

I was wondering if there is a best way to run the following command

cat cisco.log-20151103.log | grep -v "90.192.142.138" | grep -v "PIX" | grep -v "Intrusion"

I tried

cat cisco.log-20151103.log | grep -v "90.192.142.138|PIX|Intrusion"

but it doesn't work.

5

two other options

grep -v -e 90.192.142.138 -e PIX -e Intrusion cisco.log-20151103.log

and assuming fixed strings

grep -vF '90.192.142.138
PIX
Intrusion
' cisco.log-20151103.log
10

grep does not necessarily need input from a pipe, so you could do

grep -vE '90\.192\.142\.138|PIX|Intrusion' cisco.log-20151103.log

Capital E switches on regular expression mode and dots need to be escaped in this case.

  • 7
    That should be -E turns on Extended regular expression mode, which allows the alternation | of patterns. grep without -E has regular expressions and dots are meaningful. The dots should have been escaped in the question, but it's unlikely that the sequence of numbers would match anything else anyway. grep -f turns off regular expressions. – RobertL Nov 3 '15 at 12:05
  • The dots should be escaped in any case; the example given (in OP and answer) would match 190.192.142.138; so ideally the IP address piece should be anchored if possible, or include whatever delimiter is before the IP address in the log, supposing a comma "," to make things clear: grep -vE ',90\.192\.142\.138,|PIX|Intrusion' cisco.log-20151103.log – Mark Stewart Nov 3 '15 at 18:09
2

grep -vE "90.192.142.138|PIX|Intrusion" cisco.log-20151103.log

  • Since the . matches any character this also matches e.g. 90C192X142R138 and that is not what the OP asked. You should escape special (regex) characters. – Anthon Mar 31 at 7:21
0
$ grep -v -f exclude.list
$ cat exclude.list
90.192.142.138
PIX
Intrusion
  • This works fine, I'm not sure why someone downvoted it. – Joshua Goldberg Jun 7 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.