December 2003 - Legacy - lists.gtalug.org

[help with grep]
by mr6re9-mI4xJ4qlgtBiLUuM0BA3LQ＠public.gmane.org 15 Dec '03

15 Dec '03

Many Thanks, Learning is a wonderful thing. I had no idea I didn't need cat. I guess I'd only use it to append to a file as in cat >>, no? I considered the quotes but regrettfully never tried them. I definitely will not need so much sleep now. I use logwatch, but at the default level. I never attempted to customize it. It reports a number of things including lame servers, although I wish it would put a time-stamp on the lame server entries. Most of these are generated through Spamassassin MX lookups. My ultimate goal is to create some colorful charts and track some trends similar to this: http://farmer6re9.isa-geek.org/log.html ~141k w/image Thanks Again, farmer6re9 -- Eating Crow is better with MyCrowSauce -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

[help with grep]
by pmills-5bG9SNWDbRX3fQ9qLvQP4Q＠public.gmane.org 15 Dec '03

15 Dec '03

On Monday, December 15, 2003, at 07:04 AM, GDHough wrote: > Shouldn't grep DPT=22\> work? That's what I'm seeing in the man page. I believe you should get what you want if you quote the search string: grep "DPT=22\>" The shell is probably messing with your escaped character. ........................ Phillip Mills Multi-platform software development (416) 224-0714 -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

[help with grep]
by talexb-SBdzbUvMQDunS0EtXVNi6w＠public.gmane.org 15 Dec '03

15 Dec '03

How about trying grep "DPT=22 " /var/log/messages.1 > somefile to see if that works. Alternatively you might try egrep to see if it can handle the \b for a space. Alex On Mon, 15 Dec 2003, GDHough wrote: > Please, there must be an easier way... > > I am trying to automate my self induced weekly ADMIN duties. I mull through my > logs on Sunday morning after rotation. They have gotten pretty big since the > end of August so I sought a means to parse some files for information without > having to scroll through 20,000 lines. > > One nagging problem for me is with grep. For example, if I: > > grep DPT=22 /var/log/messages.1 | cat > somefile > > somefile would contain not only DPT=22, but also all 220, 2276, 22344 or any > port 22xxx. I tried the symbols \>, \b, \B thinking they would match the > emptyness at the end of DPT=22 but they did not work for me. Laugh if you > must but my solution to this dilema was to get DPT=22 by elimination using > the invert switch -v like so: > > read DIRPATH > mkdir $DIRPATH/DPT > grep DPT=22 $DIRPATH/LOG | cat > $DIRPATH/DPT/A > grep -v DPT=220 $DIRPATH/DPT/A | cat > $DIRPATH/DPT/B > grep -v DPT=221 $DIRPATH/DPT/B | cat > $DIRPATH/DPT/C > grep -v DPT=222 $DIRPATH/DPT/C | cat > $DIRPATH/DPT/D > grep -v DPT=223 $DIRPATH/DPT/D | cat > $DIRPATH/DPT/E > grep -v DPT=224 $DIRPATH/DPT/E | cat > $DIRPATH/DPT/F > grep -v DPT=225 $DIRPATH/DPT/F | cat > $DIRPATH/DPT/G > grep -v DPT=226 $DIRPATH/DPT/G | cat > $DIRPATH/DPT/H > grep -v DPT=227 $DIRPATH/DPT/H | cat > $DIRPATH/DPT/I > grep -v DPT=228 $DIRPATH/DPT/I | cat > $DIRPATH/DPT/J > grep -v DPT=229 $DIRPATH/DPT/J | cat > $DIRPATH/DPT/dp22 > echo "DPT=22" > grep -c farm $DIRPATH/DPT/dp22 > > I search for about 40 ports both source and destination. Most high numbered > ports don't require the elimination method like 8080 because 80800 doesn't > exist. > > After I get the common ports catalogued, I hope to use diff to find what's > left-over and flag those lines with same source and destination ports. Can I > simplify the above and thus remove much of the sleep in the script? > > Shouldn't grep DPT=22\> work? That's what I'm seeing in the man page. > > Thanks, > farmer6re9 > -- > Eating Crow is better with MyCrowSauce > > -- > The Toronto Linux Users Group. Meetings: http://tlug.ss.org > TLUG requests: Linux topics, No HTML, wrap text below 80 columns > How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml > > -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

[help with grep]
by c.f.a.johnson-bJEeYj9oJeDQT0dZR+AlfA＠public.gmane.org 15 Dec '03

15 Dec '03

On Mon, 15 Dec 2003, GDHough wrote: > Please, there must be an easier way... > > I am trying to automate my self induced weekly ADMIN duties. I mull through my > logs on Sunday morning after rotation. They have gotten pretty big since the > end of August so I sought a means to parse some files for information without > having to scroll through 20,000 lines. > > One nagging problem for me is with grep. For example, if I: > > grep DPT=22 /var/log/messages.1 | cat > somefile > > somefile would contain not only DPT=22, but also all 220, 2276, 22344 or any > port 22xxx. I tried the symbols \>, \b, \B thinking they would match the > emptyness at the end of DPT=22 but they did not work for me. Laugh if you > must but my solution to this dilema was to get DPT=22 by elimination using > the invert switch -v like so: > > read DIRPATH > mkdir $DIRPATH/DPT > grep DPT=22 $DIRPATH/LOG | cat > $DIRPATH/DPT/A > grep -v DPT=220 $DIRPATH/DPT/A | cat > $DIRPATH/DPT/B > grep -v DPT=221 $DIRPATH/DPT/B | cat > $DIRPATH/DPT/C > grep -v DPT=222 $DIRPATH/DPT/C | cat > $DIRPATH/DPT/D > grep -v DPT=223 $DIRPATH/DPT/D | cat > $DIRPATH/DPT/E > grep -v DPT=224 $DIRPATH/DPT/E | cat > $DIRPATH/DPT/F > grep -v DPT=225 $DIRPATH/DPT/F | cat > $DIRPATH/DPT/G > grep -v DPT=226 $DIRPATH/DPT/G | cat > $DIRPATH/DPT/H > grep -v DPT=227 $DIRPATH/DPT/H | cat > $DIRPATH/DPT/I > grep -v DPT=228 $DIRPATH/DPT/I | cat > $DIRPATH/DPT/J > grep -v DPT=229 $DIRPATH/DPT/J | cat > $DIRPATH/DPT/dp22 > echo "DPT=22" > grep -c farm $DIRPATH/DPT/dp22 > > I search for about 40 ports both source and destination. Most high numbered > ports don't require the elimination method like 8080 because 80800 doesn't > exist. > > After I get the common ports catalogued, I hope to use diff to find what's > left-over and flag those lines with same source and destination ports. Can I > simplify the above and thus remove much of the sleep in the script? > > Shouldn't grep DPT=22\> work? That's what I'm seeing in the man page. grep "DPT=\<22\>" /var/log/messages.1 > somefile ## no need for cat Or (if the number is followed by a space): grep "DPT=22 " /var/log/messages.1 > somefile To process all the ports: for port in 22 220 221 ....... do grep "DPT=\<$port\>" /var/log/messages.1 > somefile.$port done -- Chris F.A. Johnson ================================================================= cfaj-uVmiyxGBW52XDw4h08c5KA at public.gmane.org http://cfaj.freeshell.org -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

[help with grep]
by fraser-Txk5XLRqZ6CsTnJN9+BGXg＠public.gmane.org 15 Dec '03

15 Dec '03

On December 15, 2003 07:04 am, GDHough wrote: > After I get the common ports catalogued, I hope to use diff to find what's > left-over and flag those lines with same source and destination ports. Can > I simplify the above and thus remove much of the sleep in the script? Yes, use logcheck (or similar) program to do the job for you. > Shouldn't grep DPT=22\> work? That's what I'm seeing in the man page. You are searching for DPT=22> ... there is no > in the iptables. You could search for port number followed by a space. grep 'DPT=22 ' /var/log/messages -- Fraser Campbell <fraser-Txk5XLRqZ6CsTnJN9+BGXg at public.gmane.org> http://www.wehave.net/ Georgetown, Ontario, Canada Debian GNU/Linux -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

[help with grep]
by f.e.jack-bJEeYj9oJeDQT0dZR+AlfA＠public.gmane.org 15 Dec '03

15 Dec '03

If you want to grep for DPT=22 followed by a space, then grep for it: grep 'DPT=22 ' file ^ space! Why do you pipe to "cat" and redirect? Direct redirection should also have the desired effect: grep 'DPT=22 ' file > dp22 The reason that grep DPT=22\> doesn't work is that the \> probably gets grabbed by your shell and handed to grep as a bare >, the \ being the shell escape character, so what grep actually sees is DPT=22>. Quote-protect the grep pattern so the shell doesn't mess around with it. grep 'DPT=22\>' file > dp22 Bonne chance, Andy -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

[help with grep]
by mr6re9-mI4xJ4qlgtBiLUuM0BA3LQ＠public.gmane.org 15 Dec '03

15 Dec '03

Please, there must be an easier way... I am trying to automate my self induced weekly ADMIN duties. I mull through my logs on Sunday morning after rotation. They have gotten pretty big since the end of August so I sought a means to parse some files for information without having to scroll through 20,000 lines. One nagging problem for me is with grep. For example, if I: grep DPT=22 /var/log/messages.1 | cat > somefile somefile would contain not only DPT=22, but also all 220, 2276, 22344 or any port 22xxx. I tried the symbols \>, \b, \B thinking they would match the emptyness at the end of DPT=22 but they did not work for me. Laugh if you must but my solution to this dilema was to get DPT=22 by elimination using the invert switch -v like so: read DIRPATH mkdir $DIRPATH/DPT grep DPT=22 $DIRPATH/LOG | cat > $DIRPATH/DPT/A grep -v DPT=220 $DIRPATH/DPT/A | cat > $DIRPATH/DPT/B grep -v DPT=221 $DIRPATH/DPT/B | cat > $DIRPATH/DPT/C grep -v DPT=222 $DIRPATH/DPT/C | cat > $DIRPATH/DPT/D grep -v DPT=223 $DIRPATH/DPT/D | cat > $DIRPATH/DPT/E grep -v DPT=224 $DIRPATH/DPT/E | cat > $DIRPATH/DPT/F grep -v DPT=225 $DIRPATH/DPT/F | cat > $DIRPATH/DPT/G grep -v DPT=226 $DIRPATH/DPT/G | cat > $DIRPATH/DPT/H grep -v DPT=227 $DIRPATH/DPT/H | cat > $DIRPATH/DPT/I grep -v DPT=228 $DIRPATH/DPT/I | cat > $DIRPATH/DPT/J grep -v DPT=229 $DIRPATH/DPT/J | cat > $DIRPATH/DPT/dp22 echo "DPT=22" grep -c farm $DIRPATH/DPT/dp22 I search for about 40 ports both source and destination. Most high numbered ports don't require the elimination method like 8080 because 80800 doesn't exist. After I get the common ports catalogued, I hope to use diff to find what's left-over and flag those lines with same source and destination ports. Can I simplify the above and thus remove much of the sleep in the script? Shouldn't grep DPT=22\> work? That's what I'm seeing in the man page. Thanks, farmer6re9 -- Eating Crow is better with MyCrowSauce -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

lilo -v -t says nothing?
by fraser-Txk5XLRqZ6CsTnJN9+BGXg＠public.gmane.org 14 Dec '03

14 Dec '03

On December 14, 2003 11:27 pm, Alan Cohen wrote: > On Sun, 2003-12-14 at 19:59, Fred Nastos wrote: > > On December 14, 2003 07:50 pm, Alan Cohen wrote: > > > up2date downloaded a new kernel and now (when I want to test it) > > > /sbin/lilo -v -t says little or nothing! > > > > Can you show us the output of > > $] ls /boot > > cd /boot > ls -ld * > drwxr-xr-x 2 1024 Dec 6 22:10 grub You sure that you're using lilo and not grub? -- Fraser Campbell <fraser-Txk5XLRqZ6CsTnJN9+BGXg at public.gmane.org> http://www.wehave.net/ Georgetown, Ontario, Canada Debian GNU/Linux -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

lilo -v -t says nothing?
by nastos-JAjqph6Yjy8fbXvGcxQkLSwD8/FfD2ys＠public.gmane.org 14 Dec '03

14 Dec '03

On December 14, 2003 11:27 pm, Alan Cohen wrote: > (snip) > -rw-r--r-- 1 520771 Aug 18 11:34 System.map-2.4.20-20.9 > -rw-r--r-- 1 520771 Dec 1 11:56 System.map-2.4.20-24.9 > -rw-r--r-- 1 518292 Feb 27 2003 System.map-2.4.20-6 > -rw-r--r-- 1 3180534 Aug 18 11:34 vmlinux-2.4.20-20.9 > -rw-r--r-- 1 3180534 Dec 1 11:56 vmlinux-2.4.20-24.9 > -rw-r--r-- 1 3149037 Feb 27 2003 vmlinux-2.4.20-6 > lrwxrwxrwx 1 19 Dec 6 22:10 vmlinuz -> vmlinuz-2.4.20-24.9 > -rw-r--r-- 1 1117322 Aug 18 11:34 vmlinuz-2.4.20-20.9 > -rw-r--r-- 1 1117198 Dec 1 11:56 vmlinuz-2.4.20-24.9 > -rw-r--r-- 1 1117057 Feb 27 2003 vmlinuz-2.4.20-6 It looks like everything is there. Try running $] lilo -t -v -v (-v times two gives even more info). If that doesn't give anything, then what happens if you do the following: i) create an empty file called test_lilo.cfg $] touch test_lilo.cfg ii) as root, run $] lilo -t -C test_lilo.cfg It should say "Fatal: No images have been defined." > > It was my understanding that up2date properly installs the kernel, and > > runs /sbin/lilo for you, and if that fails then it tells you... but I may > > be mistaken. > > up2date did modify lilo.conf but didn't run /sbin/lilo > (However it did advise me to do so.) Hmm... to install a new kernel when using lilo, /sbin/lilo must be run, right? I've up2dated my kernel about seven times in the past couple of years using up2date, and I never had to run /sbin/lilo myself. I've had to do everything by hand if I removed a kernel, but not when downloading. The kernel was downloaded from redhat? > In any case, I would have at least > expected /sbin/lilo -t to at least say something like > "The boot sector and the map files has NOT been altered" Yes, I would have expected that also. -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

lilo -v -t says nothing?
by alan-QVObF66B6qeOg/Yh5kgvkFaTQe2KTcn/＠public.gmane.org 14 Dec '03

14 Dec '03

On Sun, 2003-12-14 at 19:59, Fred Nastos wrote: > On December 14, 2003 07:50 pm, Alan Cohen wrote: > > > > up2date downloaded a new kernel and now (when I want to test it) > > /sbin/lilo -v -t says little or nothing! > > Can you show us the output of > $] ls /boot cd /boot ls -ld * (All files owner=root group=root) -rw-r--r-- 1 512 Oct 8 09:28 boot.0300 -rw-r--r-- 1 512 Oct 8 09:28 boot.0340 -rw-r--r-- 1 5824 Jan 25 2003 boot.b -rw-r--r-- 1 612 Jan 25 2003 chain.b -rw-r--r-- 1 44696 Aug 18 11:34 config-2.4.20-20.9 -rw-r--r-- 1 44696 Dec 1 11:56 config-2.4.20-24.9 -rw-r--r-- 1 44252 Feb 27 2003 config-2.4.20-6 drwxr-xr-x 2 1024 Dec 6 22:10 grub -rw-r--r-- 1 157175 Oct 7 18:46 initrd-2.4.20-20.9.img -rw-rw-r-- 1 156943 Dec 6 22:10 initrd-2.4.20-24.9.img -rw-r--r-- 1 157782 Sep 29 20:55 initrd-2.4.20-6.img -rw-r--r-- 1 479 Sep 29 21:38 kernel.h drwx------ 2 12288 Sep 29 16:51 lost+found -rw------- 1 31744 Oct 8 09:59 map.0301 -rw------- 1 31744 Oct 8 09:59 map.0341 -rw-r--r-- 1 23108 Feb 24 2003 message -rw-r--r-- 1 21282 Feb 24 2003 message.ja lrwxrwxrwx 1 23 Dec 6 22:10 module-info -> module-info-2.4.20-24.9 -rw-r--r-- 1 15438 Aug 18 11:34 module-info-2.4.20-20.9 -rw-r--r-- 1 15438 Dec 1 11:56 module-info-2.4.20-24.9 -rw-r--r-- 1 15436 Feb 27 2003 module-info-2.4.20-6 -rw-r--r-- 1 640 Jan 25 2003 os2_d.b lrwxrwxrwx 1 22 Dec 6 22:36 System.map -> System.map-2.4.20-20.9 -rw-r--r-- 1 520771 Aug 18 11:34 System.map-2.4.20-20.9 -rw-r--r-- 1 520771 Dec 1 11:56 System.map-2.4.20-24.9 -rw-r--r-- 1 518292 Feb 27 2003 System.map-2.4.20-6 -rw-r--r-- 1 3180534 Aug 18 11:34 vmlinux-2.4.20-20.9 -rw-r--r-- 1 3180534 Dec 1 11:56 vmlinux-2.4.20-24.9 -rw-r--r-- 1 3149037 Feb 27 2003 vmlinux-2.4.20-6 lrwxrwxrwx 1 19 Dec 6 22:10 vmlinuz -> vmlinuz-2.4.20-24.9 -rw-r--r-- 1 1117322 Aug 18 11:34 vmlinuz-2.4.20-20.9 -rw-r--r-- 1 1117198 Dec 1 11:56 vmlinuz-2.4.20-24.9 -rw-r--r-- 1 1117057 Feb 27 2003 vmlinuz-2.4.20-6 > and can you tell us what distribution you are using (I assume some form of > redhat since you are using up2date). RedHat 9.0 uname -a Linux tsx3 2.4.20-20.9 #1 Mon Aug 18 11:27:43 EDT 2003 i686 athlon i386 GNU/Linux > It was my understanding that up2date properly installs the kernel, and runs > /sbin/lilo for you, and if that fails then it tells you... but I may be > mistaken. up2date did modify lilo.conf but didn't run /sbin/lilo (However it did advise me to do so.) In any case, I would have at least expected /sbin/lilo -t to at least say something like "The boot sector and the map files has NOT been altered" > > /etc/lilo.conf ------------------------------------------------ > > prompt > > timeout=50 > > ##default=linux > > default=2.4.20-20.9 > > boot=/dev/md0 > > map=/boot/map > > install=/boot/boot.b > > message=/boot/message > > linear > > > > image=/boot/vmlinuz-2.4.20-24.9 > > ### label=linux > > label=2.4.20-24.9 > > initrd=/boot/initrd-2.4.20-24.9.img > > read-only > > root=/dev/md1 > > > > image=/boot/vmlinuz-2.4.20-20.9 > > label=2.4.20-20.9 > > initrd=/boot/initrd-2.4.20-20.9.img > > read-only > > root=/dev/md1 > > > > image=/boot/vmlinuz-2.4.20-6 > > label=2.4.20-20.6 > > initrd=/boot/initrd-2.4.20-6.img > > read-only > > root=/dev/md1 > -- > The Toronto Linux Users Group. Meetings: http://tlug.ss.org > TLUG requests: Linux topics, No HTML, wrap text below 80 columns > How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml -- -------------------------------------- Please do not respond in HTML Alan Cohen alan-QVObF66B6qeOg/Yh5kgvkFaTQe2KTcn/(a)public.gmane.org voice: 416-783-9826 fax: 240-269-7457 -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0