Skip to content

Virtually Caffeinated

A double-shot of knowledge

Menu
  • About Me
  • Useful Links

About Me

Profile
Jeremy Wheeler

I am an experienced Consulting Architect for VMware’s Professional Services Organization, End-user Computing specializing in VMware Horizon Suite product-line and SDDC. I have over 23 years of experience in the IT industry. In addition to his past experience, I have a passion for technology and thrives on educating customers. Additionally, I have 10 years of hands-on virtualization experience deploying full-life cycle solutions using VMware, CITRIX, and Hyper-V. I also has 18 years of experience in computer programming in various languages ranging from basic scripting to C, C++, PERL, .NET, SQL, and PowerShell. I’ve received acclaim from several clients for my in-depth and varied technical experience and exceptional hands-on customer satisfaction skills. In February 2013, I received VMware’s Spotlight award for my outstanding persistence and dedication to customers and was nominated again in October of 2013. I was awarded 2015 – 2017 vEXPERT.

  • Home
  • 2021
  • January
  • 4
  • Log Parsing Cheat Sheet
General Toolbox

Log Parsing Cheat Sheet

Jeremy Wheeler
January 4, 2021January 4, 2021 3 mins

Hey all! So, Doug Arcidino shared with some of our team today this cool cheat sheet that Thomas Roccia @fr0gger_ created. Thomas posted on Twitter two infographics (seen below). I converted the images to text so it’s easier to copy/paste from.

GREPGREP allows you to
search patterns in files.
ZGREP for GZIP files.
$grep <pattern> file.log
-n: Number of lines that matches
-i: Case insensitive
-v: Invert matches
-E: Extended regex
-c: Count number of matches
-I: Find filenames that matches the pattern
NGREPNGREP is used for
analyzing network
packets.
$ngrep -I file.pcap
-d: Specify network interface
-i: Case insensitive
-x: Print in alternate hexdump
-t: Print timestamp
-I: Read pcap file
CUTThe CUT command is
used to parse fields
from delimited logs.
$cut -d -f  2 file.log
-d: Use the field delimiter
-f: The field numbers
-c: Specifies characters position
SEDSED (Stream Editor) is
used to replace strings
in a file.
$sed s/regex/replace/g
s: Search
g: Replace
d: Delete
W: Append to file
-e: Execute command
-n: Suppress output
SORTSORT is used to sort a file.
$sort foo.txt
-o: Output to file
-r: Reverse order
-n: Numerical sort
-k: Sort by column.
-c: Check if ordered
-u: Sort and remove
-f: Ignore case
-h: Human sort
UNIQUNIQ is used to extract
uniq occurrences.
$uniq foo.txt
-c: Count the number of duplicates
-d: Print duplicates
-i: Case insensitive
DIFFDIFF is used to display
differences in files by
comparing line by line.
$diff foo.log bar.log
How +o read output?
a: Add
c: Change
d: Delete
#: Line numbers
<: File 1
<: File 2
AWKAWK is a programming
language use to
manipulate data.
$awk {print $2} foo.log
Print first column with separator
$awk -F: ‘{print $I}’ /etc/passwd

Extract uniq value from two files:
$awk ‘FNR==NR {a[$0]++; next} |($0 in a)’ fl.txt f2.txt
HEADHEAD ¡s used to display
the first 10 lines of a file by default.
$head file.log
-n: Number of lines to display
-c: Number of bytes to display
TAILTAIL is used to display
the last 10 lines of a
file by default.
$tail file.log
-n: Number of lines to display
-f: Wait for additional data
-F: Same as -f even if file is rotated
CSVCUTLESS is used to
visualize the content
of a file, faster than
MORE. ZLESS for
compressed files,
$less file.log
space: Display next page
/: Search
n: Next
g: Beginning of the file
G: Start of the file
+F: Like tail -f
JQCOMM is used to
select or reject lines
common to two files.
$comm foo.log bar.log
Three columns as output:
Column 1: lines only in file 1
Column 2: lines only in file 2
Column 3: lines in both files
-1, -2, -3 Suppress columns output
CSVCUTCSVCUT is used to
parse CSV files.
$csvcut -c 3 data.csv
-n: Print columns name
-c: Extract the specified column
-C: Extract all columns except specified one
-x: Delete empty rows
JQJQ is used to parse
JSON files.
$jq foojson
jq . f.json: Pretty print
jq ‘.[]’ f.json: Output elements from arrays
jq ‘.[0]’.<keyname>’ f.json
TRTR is used to replace a
character in a file.
$tr “;” “,” < foo.txt
-d: Delete character
-s: Compress characters to a single one
Lower to upper every character:
tr “[:lower:]” “[:upper:]” < foo.txt
CCZECCZE is used to color
logs.
$ccze < foo.log
-h: Output in html
-C: Convert Unix timestamp
-l: List available plugins
-p: Load specified plugin

Share :
whosay

Written by  Jeremy Wheeler: Jeremy

Post navigation

Previous: Virtually There: Presentations that Pop!

Related Post

vt thumbnail

Virtually There: Presentations that Pop!

Blocksizes of VMFS

Windows Ghost Network Adapters

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Categories

Recent Posts

  • Log Parsing Cheat Sheet
  • Virtually There: Presentations that Pop!
  • Cool Resources for your Kids at home during this time..
  • Move OmniGraffle Package to Flat Format
  • VMware User Environment Manager and Sysinternals BGinfo

Archives

RSS Press Releases

  • VMware Named 2022 HPE Global Technology Partner of the Year June 28, 2022
    VMware recognized for embodying partnership-first value and commitment to helping mutual customers unleash their growth potential and achieve better business outcomes LAS VEGAS--(BUSINESS WIRE)-- HPE DISCOVER – VMware, Inc. (NYSE: VMW) today announced the company was named the 2022 HPE Global Technology Partner of the Year. This award recognizes VMware as an HPE partner that […]
  • VMware Unveils vSphere+ and vSAN+ to Simplify Operations with Centralized Infrastructure Management, Increase Developer Velocity with Integrated Kubernetes, and Extend On-Premises with Hybrid Cloud Services June 28, 2022
    PALO ALTO, Calif.--(BUSINESS WIRE)-- VMware, Inc. (NYSE: VMW) today unveiled VMware vSphere+ and VMware vSAN+ to help organizations bring the benefits of the cloud to their existing on-premises infrastructure with no disruption to their workloads or hosts. Introduced at VMworld 2021 as a technology preview known as Project Arctic, these new offerings will help customers […]
  • VMware Named a Leader in Three Unified Endpoint Management IDC MarketScape Vendor Assessments June 16, 2022
    VMware positioned as a Leader in Unified Endpoint Management (UEM) Software, UEM Software for Apple Devices, and UEM Software for Ruggedized/IoT Device Deployments PALO ALTO, Calif.--(BUSINESS WIRE)-- VMware Inc. (NYSE: VMW), a leading innovator in enterprise software, today announced it has been positioned as a Leader in three recent IDC MarketScape reports related to the […]
Copyright VMBUCKET.COM © 2020