warhansen warhansen - 2 months ago 27
Bash Question

Need grep statement to exclude lines

I am running ufw in "open" mode just to collect stats to see if there are any attempts to access the server. UFW is running in "medium" logging so I can see all access to the server. When I check ufw.log, I need to run through the whole list manually.

I currently use:

grep 'IN=eth0' uwf.log


But this still leaves too many records for me to check manually

What I really need is:


  • Grep must only look for lines that contain IN=eth0 ( This part is
    easy)

  • Grep must IGNORE lines with SRC=0.0.0.0 (These are dhcp broadcasts)

  • Grep must IGNORE lines with SRC=10.0.1.15 (10.0.X.X is my Nagios checking ftp service)



Can someone please help,

Thank you.

Answer

I would use awk:

awk '/IN=eth0/ && !/SRC=0\.0\.0\.0/ && !/SRC=10\.0\.1\.15/' uwf.log

Since awk supports boolean operations, multiple conditions can be expressed in a pretty simple way.