LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 04-08-2011, 06:42 PM   #1
dimeetrees
LQ Newbie
 
Registered: Apr 2011
Posts: 4

Rep: Reputation: 0
How to break down a grep command


What does this command mean?

grep 'GET / HTTP.*Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1' last10m |cut -d ' ' -f1 |sort -n |uniq -c|sort -n|tail

Whats the best way to figure out these commands in general? I have a lot of learning to do!
 
Old 04-08-2011, 06:44 PM   #2
Tinkster
Moderator
 
Registered: Apr 2002
Location: earth
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928
Hi, welcome to LQ!

I'd suggest you run it, and try to determine what it does by
the results; you may find the man-pages of each of the tools
a great help in understanding what they do.


Cheers,
Tink
 
Old 04-08-2011, 06:50 PM   #3
markush
Senior Member
 
Registered: Apr 2007
Location: Germany
Distribution: Slackware
Posts: 3,979

Rep: Reputation: Disabled
Hello dimeetrees, welcome to LQ,

the part
Code:
'GET / HTTP.*Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1'
seems to be the string which is searched for. The rest of the command includes other Linux-tools, I'd recommend to read the manpages
Code:
man bash
man sort
man cut
man tail
...
Markus
 
Old 04-08-2011, 06:57 PM   #4
dimeetrees
LQ Newbie
 
Registered: Apr 2011
Posts: 4

Original Poster
Rep: Reputation: 0
I'm a complete newbie in the linux terminal, and my hosting provider keeps giving me some commands to use and the output doesn't make it easier, for example:

194 58.91.131.10
198 95.220.68.95
206 200.60.251.151
209 113.22.68.87
225 87.21.218.25
248 109.185.177.60
256 84.94.63.202
275 65.100.210.134
297 95.170.191.6
314 190.178.139.12


There's nothing explaining what the numbers to the left of the ip's mean. When I try to get help in linux it doesn't really make it easier either. Is there some sort of definitive manual you would recommend that makes it easier to figure this stuff out?

Quote:
Originally Posted by Tinkster View Post
Hi, welcome to LQ!

I'd suggest you run it, and try to determine what it does by
the results; you may find the man-pages of each of the tools
a great help in understanding what they do.


Cheers,
Tink
 
Old 04-08-2011, 10:47 PM   #5
7sicks
LQ Newbie
 
Registered: Apr 2011
Posts: 1

Rep: Reputation: 0
suggestion

"grep 'GET / HTTP.*Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1' last10m |cut -d ' ' -f1 |sort -n |uniq -c|sort -n|tail"

grep searching the file last10m (a website request log from the looks of it) for the string 'GET / HTTP.*Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1'. Every | starts a new command, and it looks like they are filtering and sorting the results. Tail just shows the last 10 lines of the output, to prevent screen scrolling, or to show the most recent data. Couldn't tell you what exactly the first column means. Try tail last10m and maybe you can figure it out looking at the full entries rather than the filtered output.

Brian
 
Old 04-08-2011, 11:07 PM   #6
Tinkster
Moderator
 
Registered: Apr 2002
Location: earth
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928
Quote:
Originally Posted by 7sicks View Post
"grep 'GET / HTTP.*Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1' last10m |cut -d ' ' -f1 |sort -n |uniq -c|sort -n|tail"

grep searching the file last10m (a website request log from the looks of it) for the string 'GET / HTTP.*Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1'. Every | starts a new command, and it looks like they are filtering and sorting the results. Tail just shows the last 10 lines of the output, to prevent screen scrolling, or to show the most recent data. Couldn't tell you what exactly the first column means. Try tail last10m and maybe you can figure it out looking at the full entries rather than the filtered output.

Brian
Code:
sort -n |uniq -c|sort -n
This gives it away; sort numeric; count the number of unique occurrences
of each IP, and sort that numerically in ascending order. In other words:

The whole thing tells you the top 10 IPs visiting your site, and just how
often they did visit, w/ the most frequent one at the bottom.


Cheers,
Tink


P.S.: Please, OP, pretty please; do not "top post" - it's a nasty habit
in e-Mail, and it's even uglier here because it adds no value whatsoever.
 
Old 04-09-2011, 12:10 AM   #7
dimeetrees
LQ Newbie
 
Registered: Apr 2011
Posts: 4

Original Poster
Rep: Reputation: 0
Thanks for the responses and explanations. Sorry about the top post tinker, I could see what you mean.
 
Old 04-09-2011, 12:11 AM   #8
dimeetrees
LQ Newbie
 
Registered: Apr 2011
Posts: 4

Original Poster
Rep: Reputation: 0
Would you guys recommend any resources on learning linux inside and out? Something that uses examples and explains all the concepts?
 
Old 04-09-2011, 04:05 AM   #9
markush
Senior Member
 
Registered: Apr 2007
Location: Germany
Distribution: Slackware
Posts: 3,979

Rep: Reputation: Disabled
Well, install Slackware http://www.slackware.org/ and take a look into the Slackware-part of LQ: http://www.linuxquestions.org/questions/slackware-14/
Also read the Slackbook: http://www.slackbook.org/
This will teach you Linux.

Markus
 
Old 04-09-2011, 04:17 PM   #10
Tinkster
Moderator
 
Registered: Apr 2002
Location: earth
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928
Quote:
Originally Posted by dimeetrees View Post
Would you guys recommend any resources on learning linux inside and out? Something that uses examples and explains all the concepts?
Just going back to the initial question: one way to
finding out what is going on really is to use the man-
page, and then disect the command line.


Code:
grep 'GET / HTTP.*Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1' last10m |cut -d ' ' -f1 |sort -n |uniq -c|sort -n|tail
Personally I always learn best by example, followed by
(or accompanied with) an explanation. So, in the case
above, just use the grep by itself initially, and compare
that to the actual files content. Read "man grep".

Then see what
Code:
grep 'GET / HTTP.*Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1' last10m |cut -d ' ' -f1
does, and read "man cut" to understand the options it was
invoked w/ and get a feel for what cut does.

Next, try the third one tacked on:
Code:
grep 'GET / HTTP.*Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1' last10m |cut -d ' ' -f1 |sort -n
read "man sort" alongside ... and so forth. And as it
bears an actual relation to what you're doing (need to
do) it should stick fairly well.



Cheers,
Tink
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
how to break a kernel 2.6.28.13 of ubuntu 9.04 using command line begawa Linux - Newbie 3 07-09-2009 01:59 AM
How to pass the result of a command to another command (like grep) desb01 Programming 4 06-25-2009 12:09 PM
Help me in Grep Command + cd command in single line JeiPrakash Linux - Newbie 3 05-27-2008 04:16 AM
Page break command gubak Linux - Newbie 1 03-13-2007 04:27 AM
Telnet break command (RedHat) rainman4_8 Linux - Software 1 03-22-2006 07:25 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 09:30 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration