Commands tagged zgrep (3)

  • This command checks for the number of times when someone has tried to login to your server and failed. If there are a lot, then that user is being targeted on your system and you might want to make sure that user either has remote logins disabled, or has a strong password, or both. If your output has an "invalid" line, it is a summary of all logins from users that don't exist on your system. Show Sample Output


    9
    zgrep "Failed password" /var/log/auth.log* | awk '{print $9}' | sort | uniq -c | sort -nr | less
    dbart · 2009-03-03 13:45:56 4
  • I use zgrep because it also parses non gzip files. With ls -tr, we parse logs in time order. Greping the empty string just concatenates all logs, but you can also grep an IP, an URL...


    2
    zgrep -h "" `ls -tr access.log*`
    dooblem · 2010-06-19 09:44:05 1
  • This will extract all the apt-get install commands issued on the box, even if they are in the gzipped history files. Show Sample Output


    0
    zgrep --color=always 'get install' /var/log/apt/history.log*
    saherr1969 · 2012-04-18 00:06:14 0

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands


Check These Out

Remove color codes (special characters) with sed
Removes ANSI color and end of line codes to the [{attr1};...;{attrn}m format.

Salvage a borked terminal
This works in some situations where 'reset' and the other alternatives don't.

Find usb device in realtime
Using this command you can track a moment when usb device was attached.

Create a zip archive excluding all SVN folders

Fast, built-in pipe-based data sink
This is shorter and actually much faster than >/dev/null (see sample output for timings) Plus, it looks like a disappointed face emoticon.

pretend to be busy in office to enjoy a cup of coffee
Create a progress dialog with custom title and text using zenity.

Which processes are listening on a specific port (e.g. port 80)
swap out "80" for your port of interest. Can use port number or named ports e.g. "http"

Substitute spaces in filename with underscore
Substitute spaces in filename with underscore, it work on the first space encountered.

Write comments to your history.
A null operation with the name 'comment', allowing comments to be written to HISTFILE. Prepending '#' to a command will *not* write the command to the history file, although it will be available for the current session, thus '#' is not useful for keeping track of comments past the current session.

Replace spaces in a file with hyphens


Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: