I want to grab relevant lines out of an SNMP logger in real-time and move them over to my application server for checking. The second half is fine, scp is doing the trick. The first half is causing me some grief.

What I want to do is check the three latest log files for the relevant messages. So I'd do: [user@SNMPServer]$ cd /var/opt/OV/log/nnm/; files=`ls -t | grep -m 3 trap.csv`; echo $files

trap.csv trap.csv.2019-05-31_07_00_01 trap.csv.2019-05-31_06_00_01

Which is great, because I then plan to:

[user@SNMPServer]$ grep $ipAddress $files

Which again, works fine when I run it on the SNMP server.

When I do it from my VM However,
admin@alarmux:~$sudo ssh p210243@ "cd /var/opt/OV/log/nnm/; files=`ls -t | grep -m 3 trap.csv`; echo $files"

I get this output:
assets bash: testerlog: command not found bash: count.txt: command not found

These are the ls -t results from my VM's home directory, not the remote one. Am I missing escape characters somewhere?

  • remove double tile for files – Siva May 31 '19 at 11:40
  • Sorry I should've noted this - they're only there to keep Stack's formatting consistent. If I single tilde them they become plaintext. Edit: Fixed – KuboMD May 31 '19 at 11:43

Backquotes and $( … ) interpolate inside double quotes. Use single quotes and it will work.

sudo ssh p210243@ 'cd /var/opt/OV/log/nnm/; files=`ls -t | grep -m 3 trap.csv`; echo $files'

Or avoid the subshell altogether with xargs:

sudo ssh p210243@ 'ls -td /var/opt/OV/log/nnm/* | grep -m 3 trap.csv | xargs grep '$ipAddress
  • Thank you, xargs works very well. To suggest an edit I would include the cd in that line as well since the xargs grep won't work without the full path. Will accept the answer once the timer is up! (2 min or so.) – KuboMD May 31 '19 at 11:48
  • 1
    oh right. Adding /* to the ls and -d yields full paths in the output; edited. – Oh My Goodness May 31 '19 at 11:50
  • 1
    @KuboMD why do you want a cd in the first place? Why not just files=$(ls -t /var/opt/OV/log/nnm/ | grep -m 3 trap.csv)? – terdon May 31 '19 at 12:08
  • 1
    @KuboMD $2 and $3 are inside single quotes, that means they'll be resolved on the remote end, where they are not defined. You need to have them outside of single quotes, so that the local end gets to resolve them: 'ls -td /var/opt/OV/log/nnm/* | grep -m 3 trap.csv | xargs grep '$3' > ~/trapFolder/'$2 – Oh My Goodness May 31 '19 at 12:32
  • 1
    @KuboMD my apologies, I didn't mean to come across as condescending. I thought there might be a specific reason why you were doing this (the sudo shh might make sense if the ssh key is only available for root for some reason and the cd might make sense if you didn't want the full path to be included in the results). I was asking to see what your reason was so I could perhaps offer an alternative. In any case, thank you for letting me know how that came across since I really didn't mean to be condescending. – terdon May 31 '19 at 12:37

With the zsh shell, the three files with the most recent modification timestamp, with filenames matching *trap.cvs in the /var/opt/OV/log/nnm directory, would be had with the pattern


where (...) modifies the behaviour of the preceding pattern. . selects only regular files (not directory names etc.) and om orders by decreasing modification timestamp. The [1,3] returns the first three matches only (or less if there are fewer matches).

So if you have the zsh shell installed on the remote machine, you would be able to do

ssh p210243@ zsh -c 'grep -wF "$1" /var/opt/OV/log/nnm/*trap.cvs(.om[1,3])' zsh "$ipAddress"

This would launch grep to look for the IP address kept in $ipAddress in the three most recently modified files on the remote system.

The flags used with grep makes it use string comparisons rather than regular expression matches (that's -F), and it requires that the matching string is a full word (that's -w; so that is not matched by

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.