I'm trying to print all root accesing attempts from /var/log/auth.log with grep. But it seems like grep isn't processing the whole file, instead grep is stopping at some point:
> less /var/log/auth.log | grep Accepted
Apr 10 08:32:43 sshd[16845]: Accepted password for root from ... port 49061 ssh2
Apr 10 09:42:38 sshd[15451]: Accepted password for root from ... port 48990 ssh2
Apr 10 10:11:17 sshd[21592]: Accepted password for root from ... port 48686 ssh2
Apr 10 12:09:03 sshd[5757]: Accepted password for root from ... port 62535 ssh2
Apr 11 18:12:12 sshd[1804]: Accepted password for root from ... port 40765 ssh2
Apr 11 18:12:30 sshd[1884]: Accepted password for root from ... port 40808 ssh2
Apr 11 18:13:46 sshd[2063]: Accepted password for root from ... port 40735 ssh2
Apr 11 19:58:44 sshd[17103]: Accepted password for root from ... port 40684 ssh2
Apr 11 20:48:06 sshd[24583]: Accepted password for root from ... port 40466 ssh2
Binary file (standard input) matches
As we can see, there are only entries until the Apr 11th. So if I try the following command:
> less /var/log/auth.log | grep "Apr 12"
Binary file (standard input) matches
Nothing gets printed. But in the file /var/log/auth.log the "Apr 12" entries are present as we can see if I run this command (I also proved it by printing the whole file with cat):
> less /var/log/auth.log | grep -c "Apr 12"
4297
I don't understand what I am doing wrong with my first grep command.
grep "Apr 12" /var/log/auth.log