warhansen warhansen - 2 months ago 27
Bash Question

Need grep statement to exclude lines

I am running ufw in "open" mode just to collect stats to see if there are any attempts to access the server. UFW is running in "medium" logging so I can see all access to the server. When I check ufw.log, I need to run through the whole list manually.

I currently use:

grep 'IN=eth0' uwf.log

But this still leaves too many records for me to check manually

What I really need is:

  • Grep must only look for lines that contain IN=eth0 ( This part is

  • Grep must IGNORE lines with SRC= (These are dhcp broadcasts)

  • Grep must IGNORE lines with SRC= (10.0.X.X is my Nagios checking ftp service)

Can someone please help,

Thank you.


I would use awk:

awk '/IN=eth0/ && !/SRC=0\.0\.0\.0/ && !/SRC=10\.0\.1\.15/' uwf.log

Since awk supports boolean operations, multiple conditions can be expressed in a pretty simple way.