Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i try to use the following command to suppress certain lines of output that contain the strings "DST=192.168.1" or "DST=192.168.2"

tail /var/log/messages | egrep -v -e 'DST=(192\.168\.1\.1)|DST=(192\.168\.2\.1)'

My Regex doesn't work, can someone provide me a working one?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

grep -v 'DST=192\.168\.[12]\.1'
ought to do the trick.

Don't even need egrep.

--edit--

If you want to match IPs that differ in a more substantial way:

grep -v 'DST=\(a\.b\.c\.d\|x\.y\.z\.q\)'

You can add more IPs by adding another \| followed by the next IP.

In this case, you might actually want to use egrep (or grep -E, same thing) so it'll look a little nicer, like so:

grep -E -v 'DST=(a\.b\.c\.d|x\.y\.z\.q)'
share|improve this answer
    
Thanks that works, can you give me also an expression for two different ipadresses like 192.168.1.1 and 239.x.x.x? –  user56548 Oct 8 '10 at 15:00
    
Works, as a charme, i just wonder why this doesn't work proper with colortail? there some ips slips through –  user56548 Oct 8 '10 at 15:46
    
I haven't used colortail so I can't be certain, but perhaps it requires extra escaping of \s or the like? Do you know what regular expression engine colortail uses? (standard, extended, or pcre?) –  mark Oct 8 '10 at 16:56
    
uh sorry, i don't know. but i switched to multitail as you suggested in the other thread and it works really fine. –  user56548 Oct 8 '10 at 19:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.