Bookmark this page

Practice: Using grep with Logs

In this lab, you will use regular expressions and grep to locate specific log entries in log files.

Resources:
Files: /var/log/messages
Machines: serverX

Outcomes:

Using regular expressions and the grep command, you can isolate specific messages or groups of messages based on the search criteria provided.

  • Reset your serverX system.

  • Log into and set up your serverX system.

    [student@serverX ~]$ lab grep setup
  1. Elevate your privileges to gain a root login using su -.

    1. [student@serverX ~]$ su - 

  2. Craft a regular expression and use grep to display all logs in /var/log/messages from the Start Time reported by lab grep setup.

    1. The following commands assume a start time provided by the lab grep script of April 1 15:53.

      Check the current time so we know not only the starting time, but the ending time of the messages we are looking for.

      [root@serverX ~]# date
      Tue Apr  1 15:54:55 EDT 2014
    2. [root@serverX ~]# grep '^Apr  1 15:5[34]' /var/log/messages
      Apr  1 15:53:25 serverX ima_daemon[14847]: logging ACCESS: 927265f3c0e95f4ae6294451060d0717
      Apr  1 15:53:25 serverX ima_daemon[14848]: logging ACCESS: b4866e8f2ec0058abe1dc0a142e0b737
      Apr  1 15:53:25 serverX ima_daemon[14849]: logging ACCESS: 7afa51b31aabca065dd358cc475d8863
      ... Output Truncated ...

  3. Modify your regular expression to locate the first ERROR message.

    1. [root@serverX ~]# grep '^Apr  1 15:5[34].*ERROR' /var/log/messages | head -n 1
      Apr  1 15:53:30 serverX database[14877]: bad entry ERROR: 2e28564860d5c6e5151a31fd923c7b61 invalid

  4. Log messages are generated by applications. There is no adopted standard on what keywords or information should be provided as part of a log message.

    Using an option to grep, look for all logs after the start time that contain the word ERROR, ignoring the case of the regular expression.

    1. [root@serverX ~]# grep -i '^Apr  1 15:5[34].*ERROR' /var/log/messages

  5. Use the -v option with grep, as well as a regular expression, to locate the ERROR message that does not contain a checksum in its message body.

    1. In this situation, it may be useful to use one grep and regular expression to meet some of the criteria, and another to further filter the results to get the desired content.

      [root@serverX ~]# grep '^Apr  1 15:5[34].*ERROR' /var/log/messages | grep -v '[a-z0-9]\{32\}'
Revision: rh134-7-c643331