I'm looking to display just the email address in the /var/log/secure file. The email goes into a variable, so just grepping for lines won't work.

I know how to string together sed commands, but is there a cleaner way?

I could even scrap the idea altogether, if there is a cleaner way to get ssh key comment emails. I'm looking to find out which email comment, on the clients ssh key, was used to login. So far I have been using something like this..

 ssh root@localhost  "sleep 1 ; tail -1 /var/log/secure | ..."

I hope there is a better way, or at least a clean way to display just the email.

link|improve this question

80% accept rate
1  
Could you please post an (obfuscated) snippet of your log file? I have nothing on my log about SSH keys (and emails). – Matteo Oct 6 '11 at 14:48
...forgot to mention, ssh going through a wrapper script that logs those key comment emails. – TechZilla Oct 6 '11 at 20:41
I ended up finishing this soon after posting. I found a cleaner way, I got user info out of LDAP and then did a grep -o for the email. – TechZilla Oct 6 '11 at 20:44
I really, should have changed the title, to the more relevant question... but the email is in the variable, so the scripts are working. – TechZilla Oct 6 '11 at 20:49
feedback

2 Answers

up vote 1 down vote accepted

Why doesn't grep work out for you? It has the -o parameter to get only the match. So something like grep -o " .+@.+ " /var/log/secure should work. Only work out the expression to just match the email address.

link|improve this answer
I actually did the grep a small while after posting. Since you answered here first, you got the check mark anyway. – TechZilla Oct 6 '11 at 20:46
feedback

As @Matteo mentioned, I've never seen the public key informations in /var/log/secure but if you want to display only email address from a text file, you can use egrep (for extended regex) with -o option, something like this:

$ egrep -o '[^ ]+@[^ ]+' input

or you must escape the plus if you use grep:

$ grep -o '[^ ]\+@[^ ]\+' input

You can also do it with sed:

$ sed -nr 's/.* ([^ ]+@[^ ]+).*$/\1/p' input
link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.