Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've got a large multi-year access_log and I need to view all of the entries for a certain IP address from SSH. The format is:

111.111.111.111 - ...

222.222.222.222 - ...

111.111.111.111 - ...

How would I only view the log entries for 111.111.111.111? I'm running CentOS.

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Grep for it is the easiest way.

grep "^111\.111\.111\.111\b" access_log
share|improve this answer
1  
Strongly agree; small lightweight tools is the UNIX way. That said, I'd modify the regexp to "^111\.111\.111\.111". It doesn't matter for that particular ip address, but ^1.3.2.4 will also match 153.214.56.37. –  MadHatter Mar 12 '11 at 7:49
    
Good point! I think when the odds are against mismatches like that I tend to forget the escapes. –  Cakemox Mar 12 '11 at 7:56
    
Cakemox, you ask good questions! Of the 2^32 possible IP addresses, how many of them - if used unescaped - can also match other IP addresses; that is, how likely is a mismatch? I'm no mathematician, and I'm especially poor at combinatorics, but if anyone reading has the tools to provide the answer, I'd love to know it. –  MadHatter Mar 12 '11 at 8:06
    
I guess even escaping the IP might cause problems on the last octet, too. Have to throw a \b in there for good measure. As for the odds of a mismatch, no idea! I'd love to know as well. –  Cakemox Mar 12 '11 at 8:12

My obligatory gnu parallel answer:

cat access_log | parallel --pipe -k grep ^111.111.111.111

Note that requires a relatively recent version of parallel to work. The cool thing about this approach is it splits the file into multiple chunks and rungs grep on those chunks in parallel instead of running grep on the whole file. The -k option ensures that the ordering stays correct.

For a very large file that could potentially be a lot faster than a simple grep. Something to try, anyway.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.