In this lab, you will use regular expressions and grep to locate specific log entries in log files.
| Resources: | |
|---|---|
| Files: | /var/log/messages |
| Machines: | serverX |
Outcomes:
Using regular expressions and the grep command, you can isolate specific messages or groups of messages based on the search criteria provided.
Reset your serverX system.
Log into and set up your serverX system.
[student@serverX ~]$lab grep setup
Elevate your privileges to gain a root login using su -.
[student@serverX ~]$su -
Craft a regular expression and use grep to display
all logs in /var/log/messages from the
Start Time reported by lab grep setup.
The following commands assume a start time provided by the lab grep script of April 1 15:53.
Check the current time so we know not only the starting time, but the ending time of the messages we are looking for.
[root@serverX ~]#dateTue Apr 1 15:54:55 EDT 2014
[root@serverX ~]#grep '^Apr 1 15:5[34]' /var/log/messagesApr 1 15:53:25 serverX ima_daemon[14847]: logging ACCESS: 927265f3c0e95f4ae6294451060d0717 Apr 1 15:53:25 serverX ima_daemon[14848]: logging ACCESS: b4866e8f2ec0058abe1dc0a142e0b737 Apr 1 15:53:25 serverX ima_daemon[14849]: logging ACCESS: 7afa51b31aabca065dd358cc475d8863 ... Output Truncated ...
Modify your regular expression to locate the first ERROR
message.
[root@serverX ~]#grep '^Apr 1 15:5[34].*ERROR' /var/log/messages | head -n 1Apr 1 15:53:30 serverX database[14877]: bad entry ERROR: 2e28564860d5c6e5151a31fd923c7b61 invalid
Log messages are generated by applications. There is no adopted standard on what keywords or information should be provided as part of a log message.
Using an option to grep, look for all logs after the
start time that contain the word ERROR, ignoring the
case of the regular expression.
[root@serverX ~]#grep -i '^Apr 1 15:5[34].*ERROR' /var/log/messages
Use the -v option with grep, as well
as a regular expression, to locate the ERROR message that
does not contain a checksum in its message body.
In this situation, it may be useful to use one grep and regular expression to meet some of the criteria, and another to further filter the results to get the desired content.
[root@serverX ~]#grep '^Apr 1 15:5[34].*ERROR' /var/log/messages | grep -v '[a-z0-9]\{32\}'