Bookmark this page

Guided Exercise: Matching Text in Command Output with Regular Expressions

In this lab, you will search for text in the system logs and the output of commands in order to find information more efficiently.

Outcomes

You should be able to efficiently search for text in log files and configuration files.

Log in to workstation as student using student as the password.

On workstation, run the lab console-regex start command. This command runs a start script that determines if the servera machine is reachable on the network. It also installs the postfix package.

[student@workstation ~]$ lab console-regex start
  1. Use the ssh command to log in to servera as the student user. The systems are configured to use SSH keys for authentication, therefore a password is not required.

    [student@workstation ~]$ ssh student@servera
    ...output omitted...
    [student@servera ~]$  
  2. Use the sudo -i command to switch to the root user. The password for the student user is student.

    [student@servera ~]$ sudo -i
    [sudo] password for student: student
    [root@servera ~]# 
  3. The postfix package was installed today by the start script. Use the grep command to find the GID and UID for the postfix and postdrop groups and users. To reduce the output of the grep command, display all logs from a specific Start Time.

    1. Use the date command to determine the current time.

      [root@servera ~]# date
      Fri Mar 22 08:23:56 CET 2019 
    2. Use the grep command with the date, start time, and GID options to find the postfix and postdrop user's GID and UID. The lab set-up script ran a few minutes before the current time. Take this into consideration when searching the /var/log/secure log file.

      [root@servera ~]# grep '^Mar 22 08:2.*GID' /var/log/secure
      Mar 22 08:20:04 servera groupadd[2514]: group added to /etc/group: name=postdrop, GID=90
      Mar 22 08:20:04 servera groupadd[2514]: new group: name=postdrop, GID=90
      Mar 22 08:20:04 servera groupadd[2520]: group added to /etc/group: name=postfix, GID=89
      Mar 22 08:20:04 servera groupadd[2520]: new group: name=postfix, GID=89
      Mar 22 08:20:04 servera useradd[2527]: new user: name=postfix, UID=89, GID=89, home=/var/spool/postfix, shell=/sbin/nologin
  4. Modify your regular expression to locate the first two messages in the /var/log/maillog file. Notice that in this search you are not using the caret character (^) because you are not searching for the first character in a line.

    [root@servera ~]# grep 'postfix' /var/log/maillog | head -n 2
    Mar 22 08:21:02 servera postfix/postfix-script[3879]: starting the Postfix mail system
    Mar 22 08:21:02 servera postfix/master[3881]: daemon started -- version 3.3.1, configuration /etc/postfix
  5. You are required to find the name of the queue directory for the Postfix server. Search the /etc/postfix/main.cf configuration file for all information about queues. Use the -i option to ignore case distinctions.

    [root@servera ~]# grep -i 'queue' /etc/postfix/main.cf
    # testing.  When soft_bounce is enabled, mail will remain queued that
    # The queue_directory specifies the location of the Postfix queue.
    queue_directory = /var/spool/postfix
    # QUEUE AND PROCESS OWNERSHIP
    # The mail_owner parameter specifies the owner of the Postfix queue
    # is the Sendmail-compatible mail queue listing command.
    # setgid_group: The group for mail submission and queue management
  6. Confirm that postfix is writing messages to /var/log/messages. Use the less command then the slash character (/) to search the file. Press n to move to the next entry that matches the search. Use the q key to quit the less command.

    [root@servera ~]# less /var/log/messages
    ...output omitted...
    Mar 22 07:58:04 servera systemd[1]: Started Postfix Mail Transport Agent.
    ...output omitted...
    Mar 22 08:12:26 servera systemd[1]: Stopping Postfix Mail Transport Agent...
    Mar 22 08:12:26 servera systemd[1]: Stopped Postfix Mail Transport Agent.
    ...output omitted...
    /Postfix 
  7. Use the ps aux command to confirm that the postfix server is currently running. Reduce the output of ps aux by combining it with the grep command.

    [root@servera ~]# ps aux | grep postfix
    root      3881  0.0  0.2 121664  5364 ?        Ss   08:21   0:00 /usr/libexec/postfix/master -w
    postfix   3882  0.0  0.4 147284  9088 ?        S    08:21   0:00 pickup -l -t unix -u
    postfix   3883  0.0  0.4 147336  9124 ?        S    08:21   0:00 qmgr -l -t unix -u
  8. Confirm that the qmgr, cleanup, and pickup queues are correctly configured. Use the grep command with the -e option to match multiple entries in the same file. The configuration file is /etc/postfix/master.cf

    [root@servera ~]# grep -e qmgr -e pickup -e cleanup /etc/postfix/master.cf
    pickup    unix  n       -       n       60      1       pickup
    cleanup   unix  n       -       n       -       0       cleanup
    qmgr      unix  n       -       n       300     1       qmgr
    #qmgr     unix  n       -       n       300     1       oqmgr
  9. Log off from servera.

    [root@servera ~]# exit
    logout
    [student@servera ~]$ exit
    logout
    Connection to servera closed.
    [student@workstation ~]$ 

Finish

On workstation, run the lab console-regex finish script to complete this exercise.

[student@workstation ~]$ lab console-regex finish

This concludes the guided exercise.

Revision: rh134-8.2-f0a9756