I am in the prosses of decommissioning an old Redhat public BIND server and would like to find all unique IP address that are sending DNS request to this Nameserver. So far this is what I have been able to cobble together, but this command is including more than just the IP of the clients sending the request.

egrep -o [0-9]\{1,3\}[.][0-9]\{1,3\}[.][0-9]\{1,3\}[.][0-9]\{1,3\} /var/log/messages | sort | uniq -c > dns-ip-client.log

How would I go about making this work?


  • What kind of items do you get that you don't want to see in the output? Maybe you can filter out other stuff before applying your regex? e.g. grep bind | egrep -o ... – Martin Jun 20 at 15:14
  • I think it would be hard to list only valid IP addresses. I have no experience with BIND but maybe you could expand your regex with something that BIND always prints when it logs? – Arkadiusz Drabczyk Jun 20 at 15:15
  • Please provide the log entry structure of this service. – Tomasz Jun 20 at 15:18
  • 1
    Don't grep directly all the IPs from the log. First filter only BIND related entries, then grep IPs from it. – rush Jun 20 at 15:28
  • Kindly post the sample logs – Praveen Kumar BS Jun 20 at 15:48

Your quoting/escaping is tripping you up I think. Single quotes tend to make things easier:

grep 'named' /var/log/messages | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}'

Note that grep -E == egrep but "Direct invocation as either egrep or fgrep is deprecated"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.