Commands using zgrep sorted by votes

Commands using zgrep (9)

sorted by

Check for login failures and summarize

This command checks for the number of times when someone has tried to login to your server and failed. If there are a lot, then that user is being targeted on your system and you might want to make sure that user either has remote logins disabled, or has a strong password, or both. If your output has an "invalid" line, it is a summary of all logins from users that don't exist on your system. Show Sample Output
This is sample output - yours may be different.
```
3478 invalid
   1255 root
     11 mysql
      8 mail
      6 www-data
```
9

zgrep "Failed password" /var/log/auth.log* | awk '{print $9}' | sort | uniq -c | sort -nr | less

dbart · 2009-03-03 13:45:56 13
concatenate compressed and uncompressed logs

I use zgrep because it also parses non gzip files. With ls -tr, we parse logs in time order. Greping the empty string just concatenates all logs, but you can also grep an IP, an URL...
This is sample output - yours may be different.
2

zgrep -h "" `ls -tr access.log*`

dooblem · 2010-06-19 09:44:05 5
grep compressed log files without extracting

accomplishes the same thing without unzipping the whole file, and while i have never seen a log.tar.gz file that was a binary, i will concede that it might happen, so add the -a in there: zgrep -ia "string" log.tar.gz it's still shorter/easier to type...
This is sample output - yours may be different.
1

zgrep -i "string" log.tar.gz

elfinkind · 2014-09-12 20:31:13 11
zgrep across multiple files
This is sample output - yours may be different.
1

find . -name "file-pattern*.gz" -exec zgrep -H 'pattern' {} \;

jgleeson · 2018-11-23 13:15:43 510
Figure out if your kernel has an option enabled

zless /proc/config.gz
This is sample output - yours may be different.
0

zgrep CONFIG_MAGIC_SYSRQ /proc/config.gz

h3xx · 2011-07-24 02:06:09 5
Find installed packages in Ubuntu

This will extract all the apt-get install commands issued on the box, even if they are in the gzipped history files. Show Sample Output
This is sample output - yours may be different.
```
history.log:Commandline: apt-get install sysstat
history.log:Commandline: apt-get install ntop graphviz
history.log:Commandline: apt-get install tree
history.log.1.gz:Commandline: apt-get install openssh-server
history.log.1.gz:Commandline: apt-get install finger
```
0

zgrep --color=always 'get install' /var/log/apt/history.log*

saherr1969 · 2012-04-18 00:06:14 7
Retrieve a download count for URLs in apache logs
This is sample output - yours may be different.
0

zgrep 'pattern' /var/logs/apache2/access.log* | awk '{print $7}' | sort -n | uniq -c | sort -rn

funkjedi · 2016-11-30 20:14:28 15
zgrep with colour into less
This is sample output - yours may be different.
0

zgrep -i --color=always "search" file.gz | less -R

jgleeson · 2018-06-12 18:45:05 562
grep across gzip files and sort by numeric day & time
This is sample output - yours may be different.
0

zgrep -i --color=always "string" files.gz | sort -k 2,3

jgleeson · 2018-06-12 20:00:03 331

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Check These Out

List your installed Firefox extensions

Find C/C++ source files

Find C/C++ source files and headers in the current directory.

list files recursively by size

View ~/.ssh/known_hosts key information

Will return the SSH server key information for each host you have in your ~/.ssh/known_hosts file, including key size, key fingerprint, key IP address or domain name, and key type.

List out classes in of all htmls in directory

Lists out all classes used in all *.html files in the currect directory. usefull for checking if you have left out any style definitions, or accidentally given a different name than you intended. ( I have an ugly habit of accidentally substituting camelCase instead of using under_scores: i would name soemthing counterBox instead of counter_box) WARNING: assumes you give classnames in between double quotes, and that you apply only one class per element.

Automator Bash script to create Clean zips in MacOS Finder without __MACOSX metadata

Finder compresses to ZIP but always includes extraneous metadata files (__MACOSX and .DS_Store) files and folders that may confuse other programs. One alternative is creating them and then editing the ZIP. This can work standalone or in an automator script accepting multiple selections (files or folders) and creating one zip per argument/selected file without that metada.

convert single digit to double digits

Uses 'rename' to pad zeros in front of first existing number in each filename. The "--" is not required, but it will prevent errors on filenames which start with "-". You can change the "2d" to any number you want, equaling the total numeric output: aka, 4d = ????, 8d = ????????, etc. I setup a handful of handy functions to this effect (because I couldn't figure out how to insert a var for the value) in the form of 'padnum?', such as: padnum5 () { /usr/bin/rename 's/\d+/sprintf("%05d",$&)/e' -- $@ } Which would change a file "foo-1.txt" to "foo-00001.txt"

fast access to any of your favorite directory.

example: -------------------------------------------------------------------------------------------- user@ubuntu:~/workspace/SVN/haystak-repos/trunk/internal/src$ addpi -------------------------------------------------------------------------------------------- Now that directory is in the list of fast access directories. You can switch to it anytime like this: -------------------------------------------------------------------------------------------- user@ubuntu:~$ pi internal` user@ubuntu:~/workspace/SVN/haystak-repos/trunk/internal/src$ -------------------------------------------------------------------------------------------- Please note the backquote ( the symbol that shares its key with ~ in the keyboard ) pi will switch you to that directory. To see the list of all fast access directories you have to say "cat ~/.pi"

List recorded formular fields of Firefox

When you fill a formular with Firefox, you see things you entered in previous formulars with same field names. This command list everything Firefox has registered. Using a "delete from", you can remove anoying Google queries, for example ;-)

Generate diff of first 500 lines of two files

Useful for massive files where doing a full diff would take too long. This just runs diff on the first 500 lines of each. The use of subshells to feed STDIN is quite a useful construct.

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

» all commands
» commands with 3 up-votes (commandlinefu3)
» commands with 10 up-votes (commandlinefu10)
» commands using zgrep

Commands using zgrep (9) the last day the last week the last month all time sorted by date votes

What's this?

Check These Out

Stay in the loop…

Commands using zgrep (9)

sorted by