Name

greplog.sh — tool for selecting messages from Kernun logs

Synopsis

greplog.sh [-f] [-v] [-d date_from] [-D date_to] [-t time_from] [-T time_to] [-h host] [-a name] [-p pid] [-s sesid] [-r reqid] [-c component] [-n number] [-l level] [-i] [-e] [string|regexp]

Description

The greplog.sh script reads a Kernun log from the standard input and prints only messages matching all the conditions given as command line arguments.

Conditions

-a name

Select messages from a proxy with name (name of the proxy section in configuration) matching a regular expression.

-c component

Select messages with the component part of identification matching a regular expression.

-d date_from

Select messages not older than the given date. The format of the date is MMDDhhmmss, where MM = month (01–12), DD = day of month (01–31), hh = hour (00–23), mm = minute (00–59), ss = second (0–59). If the part hhmmss is omitted, 000000 is used.

-D date_to

Select messages not newer than the given date. The format of the date is like in -d. If the part hhmmss is omitted, 235959 is used.

-e

Interpret the "string|regexp" argument as a regular expression. If -e is missing, "string|regexp" is interpreted as a string.

-f

Flush output after each line of output. Lines are not buffered and are sent to the output immediately. Use this option when reading a growing log from a pipe (for example, from tail -f) and want to see each new selected line immediately when it appears in the log.

-h host

Select messages from a host specified by a regular expression.

-i

Perform case-insensitive matching.

-l level

Select messages with the level (severity) part of identification matching a regular expression. Can be either a single letter from XACEWNKIDTF, or a pair of letters separated with a hyphen (denoting an interval of levels). A letter before or after the hyphen can be omitted. Then the default X or F, respectively, will be used.

-n number

Select messages with the number part of identification matching a regular expression.

-p pid

Select messages from a proxy process with the given PID (regular expression).

-r reqid

Select messages from a proxy process with the given request id (REQID) (regular expression).

-s sesid

Select messages from a proxy process with the given session id (SESID) (regular expression).

-t time_from

Select messages with at least the given time. The format of the time is hhmmss, where hh = hour (00–23), mm = minute (00–59), ss = second (0–59).

-T time_to

Select messages with at most the given time. The format of the time is like in -t.

-v

Negate the selection. Prints only messages that are not selected by other conditions.

string|regexp

Select messages with the text after an identifier (component, number, severity code) matching a string, or a regular expression (depending on -e). If there are more "string|regexp" arguments, they are concatenated (with a space between each pair) into one regular expression.

The conditions -d and -D match messages from a single interval of time instants. On the other hand, -t and -T match a time interval each day.

Example:

greplog.sh -d 0301080000 -D 0331160000

Prints all messages generated since 8:00 on March 1 till 16:00 on March 31.

greplog.sh -d 0301 -D 0331 -t 080000 -T 160000

Prints all messages generated on any day in March between 8:00 and 16:00.

The conditions -h, -a, -p, -s, -r, -c, -n, and -l can be repeated. The occurrences of the same condition are understood as logical OR, i.e., it suffices for a message to match one of them for the condition to be satisfied. Technically, the regular expressions for the same condition are joined using (re1)|(re2).

The regular expressions in -a, -p, -s, -r, -c, -n are implicitly surrounded by '^' and '$', i.e., a whole string (of name, PID, SESID, REQID, Log-ID component, Log-ID number) is always matched.

See Also

sum-stats(1), switchlog(1), logging(7)

Authors

This man page is a part of Kernun Firewall.
Copyright © 2000–2016 Trusted Network Solutions, a. s.
All rights reserved.