Skip to content

Virtually Caffeinated

A double-shot of knowledge

Menu
  • About Me
  • Useful Links

About Me

Profile
Jeremy Wheeler

I am an experienced Consulting Architect for VMware’s Professional Services Organization, End-user Computing specializing in VMware Horizon Suite product-line and SDDC. I have over 23 years of experience in the IT industry. In addition to his past experience, I have a passion for technology and thrives on educating customers. Additionally, I have 10 years of hands-on virtualization experience deploying full-life cycle solutions using VMware, CITRIX, and Hyper-V. I also has 18 years of experience in computer programming in various languages ranging from basic scripting to C, C++, PERL, .NET, SQL, and PowerShell. I’ve received acclaim from several clients for my in-depth and varied technical experience and exceptional hands-on customer satisfaction skills. In February 2013, I received VMware’s Spotlight award for my outstanding persistence and dedication to customers and was nominated again in October of 2013. I was awarded 2015 – 2017 vEXPERT.

  • Home
  • 2021
  • January
  • 4
  • Log Parsing Cheat Sheet
General Toolbox

Log Parsing Cheat Sheet

Jeremy Wheeler
January 4, 2021January 4, 2021 3 mins

Hey all! So, Doug Arcidino shared with some of our team today this cool cheat sheet that Thomas Roccia @fr0gger_ created. Thomas posted on Twitter two infographics (seen below). I converted the images to text so it’s easier to copy/paste from.

GREPGREP allows you to
search patterns in files.
ZGREP for GZIP files.
$grep <pattern> file.log
-n: Number of lines that matches
-i: Case insensitive
-v: Invert matches
-E: Extended regex
-c: Count number of matches
-I: Find filenames that matches the pattern
NGREPNGREP is used for
analyzing network
packets.
$ngrep -I file.pcap
-d: Specify network interface
-i: Case insensitive
-x: Print in alternate hexdump
-t: Print timestamp
-I: Read pcap file
CUTThe CUT command is
used to parse fields
from delimited logs.
$cut -d -f  2 file.log
-d: Use the field delimiter
-f: The field numbers
-c: Specifies characters position
SEDSED (Stream Editor) is
used to replace strings
in a file.
$sed s/regex/replace/g
s: Search
g: Replace
d: Delete
W: Append to file
-e: Execute command
-n: Suppress output
SORTSORT is used to sort a file.
$sort foo.txt
-o: Output to file
-r: Reverse order
-n: Numerical sort
-k: Sort by column.
-c: Check if ordered
-u: Sort and remove
-f: Ignore case
-h: Human sort
UNIQUNIQ is used to extract
uniq occurrences.
$uniq foo.txt
-c: Count the number of duplicates
-d: Print duplicates
-i: Case insensitive
DIFFDIFF is used to display
differences in files by
comparing line by line.
$diff foo.log bar.log
How +o read output?
a: Add
c: Change
d: Delete
#: Line numbers
<: File 1
<: File 2
AWKAWK is a programming
language use to
manipulate data.
$awk {print $2} foo.log
Print first column with separator
$awk -F: ‘{print $I}’ /etc/passwd

Extract uniq value from two files:
$awk ‘FNR==NR {a[$0]++; next} |($0 in a)’ fl.txt f2.txt
HEADHEAD ¡s used to display
the first 10 lines of a file by default.
$head file.log
-n: Number of lines to display
-c: Number of bytes to display
TAILTAIL is used to display
the last 10 lines of a
file by default.
$tail file.log
-n: Number of lines to display
-f: Wait for additional data
-F: Same as -f even if file is rotated
CSVCUTLESS is used to
visualize the content
of a file, faster than
MORE. ZLESS for
compressed files,
$less file.log
space: Display next page
/: Search
n: Next
g: Beginning of the file
G: Start of the file
+F: Like tail -f
JQCOMM is used to
select or reject lines
common to two files.
$comm foo.log bar.log
Three columns as output:
Column 1: lines only in file 1
Column 2: lines only in file 2
Column 3: lines in both files
-1, -2, -3 Suppress columns output
CSVCUTCSVCUT is used to
parse CSV files.
$csvcut -c 3 data.csv
-n: Print columns name
-c: Extract the specified column
-C: Extract all columns except specified one
-x: Delete empty rows
JQJQ is used to parse
JSON files.
$jq foojson
jq . f.json: Pretty print
jq ‘.[]’ f.json: Output elements from arrays
jq ‘.[0]’.<keyname>’ f.json
TRTR is used to replace a
character in a file.
$tr “;” “,” < foo.txt
-d: Delete character
-s: Compress characters to a single one
Lower to upper every character:
tr “[:lower:]” “[:upper:]” < foo.txt
CCZECCZE is used to color
logs.
$ccze < foo.log
-h: Output in html
-C: Convert Unix timestamp
-l: List available plugins
-p: Load specified plugin

Share :
whosay

Written by  Jeremy Wheeler: Jeremy

Post navigation

Previous: Virtually There: Presentations that Pop!

Related Post

Windows Ghost Network Adapters

Blocksizes of VMFS

vt thumbnail

Virtually There: Presentations that Pop!

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Categories

Recent Posts

  • Log Parsing Cheat Sheet
  • Virtually There: Presentations that Pop!
  • Cool Resources for your Kids at home during this time..
  • Move OmniGraffle Package to Flat Format
  • VMware User Environment Manager and Sysinternals BGinfo

Archives

RSS Press Releases

  • VMware Unlocks Limitless Possibilities for Partners to Capture the Multi-Cloud Opportunity March 20, 2023
    Next Evolution of VMware Partner Connect Program Now Live Partner Enablement, Practice Development, and Lifecycle Incentives Now Better Aligned to Customers’ Critical Business Outcomes PALO ALTO, Calif.--(BUSINESS WIRE)-- Today, VMware, Inc. (NYSE: VMW) announced the next evolution of the company’s flagship VMware Partner Connect program is live worldwide. Partner Connect is a singular, ...
  • VMware Unveils Anywhere Workspace Innovations to Advance Automation Capabilities and Accelerate IT Modernization March 7, 2023
    Updates to VMware Workspace ONE and VMware App Volumes enable increased performance, scale, and speed of new feature delivery for customers. PALO ALTO, Calif.--(BUSINESS WIRE)-- As organizations navigate the evolving requirements of a hybrid workforce, they are challenged with managing operational complexities and obsolete tooling while supporting employees no matter the app, device, or ...
  • VMware Reports Fourth Quarter and Fiscal Year 2023 Results March 2, 2023
    FY23 Total Revenue of $13.35 billion FY23 Subscription and SaaS Revenue of $4.01 billion, an increase of 25% year-over-year PALO ALTO, Calif.--(BUSINESS WIRE)-- VMware, Inc. (NYSE: VMW), a leading innovator in enterprise software, today announced financial results for the fourth quarter and full fiscal year 2023. The company’s fourth quarter of fiscal year 2023 was […]
Copyright VMBUCKET.COM © 2020