Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking to display just the email address in the /var/log/secure file. The email goes into a variable, so just grepping for lines won't work.

I know how to string together sed commands, but is there a cleaner way?

I could even scrap the idea altogether, if there is a cleaner way to get ssh key comment emails. I'm looking to find out which email comment, on the clients ssh key, was used to login. So far I have been using something like this..

 ssh root@localhost  "sleep 1 ; tail -1 /var/log/secure | ..."

I hope there is a better way, or at least a clean way to display just the email.

share|improve this question
Could you please post an (obfuscated) snippet of your log file? I have nothing on my log about SSH keys (and emails). – Matteo Oct 6 '11 at 14:48
...forgot to mention, ssh going through a wrapper script that logs those key comment emails. – TechZilla Oct 6 '11 at 20:41
I ended up finishing this soon after posting. I found a cleaner way, I got user info out of LDAP and then did a grep -o for the email. – TechZilla Oct 6 '11 at 20:44
I really, should have changed the title, to the more relevant question... but the email is in the variable, so the scripts are working. – TechZilla Oct 6 '11 at 20:49
up vote 1 down vote accepted

Why doesn't grep work out for you? It has the -o parameter to get only the match. So something like grep -o " .+@.+ " /var/log/secure should work. Only work out the expression to just match the email address.

share|improve this answer
I actually did the grep a small while after posting. Since you answered here first, you got the check mark anyway. – TechZilla Oct 6 '11 at 20:46

As @Matteo mentioned, I've never seen the public key informations in /var/log/secure but if you want to display only email address from a text file, you can use egrep (for extended regex) with -o option, something like this:

$ egrep -o '[^ ]+@[^ ]+' input

or you must escape the plus if you use grep:

$ grep -o '[^ ]\+@[^ ]\+' input

You can also do it with sed:

$ sed -nr 's/.* ([^ ]+@[^ ]+).*$/\1/p' input
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.