LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 12-05-2018, 06:39 AM   #1
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 113

Rep: Reputation: 1
regexp / pcregrep odd behaviour ?


Can someone explain me what it wrong with the following regex ?
I have an string which look like this, from a logfile

Code:
Dec  4 16:59:31 server dovecot: auth-worker(4850): sql(silvia,186.251.225.186): unknown user
I then try so extract the IP like so, but it reverts the IP, and miss the last couple of chars ?

Code:
pcregrep -o1 "dovecot.+([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).+unknown user" test.log 
6.251.225.186
if I ommit, dovecot.+, it works, but I need to have this in as well.
Code:
pcregrep -o1 "([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).+unknown user" test.log 
186.251.225.186
I asume, it has something to do with the pharantheses in the string, "auth-worker(4850)" , or ?

Last edited by LBM; 12-05-2018 at 06:52 AM.
 
Old 12-05-2018, 07:02 AM   #2
l0f4r0
Member
 
Registered: Jul 2018
Location: Paris
Distribution: Debian
Posts: 900

Rep: Reputation: 289Reputation: 289Reputation: 289
For me it has nothing to do with parentheses. It's just because pcregrep seems greedy so your first IP digits go inside your ".+" whatever your "[0-9]{1,3}"
Try this for example and you'll see the difference:
Code:
pcregrep -o1 "dovecot.+,([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).+unknown user" test.log

Last edited by l0f4r0; 12-05-2018 at 07:05 AM.
 
1 members found this post helpful.
Old 12-05-2018, 07:22 AM   #3
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 113

Original Poster
Rep: Reputation: 1
Nice, that did the trick! thx man!
But what does the "," do here ?

Last edited by LBM; 12-05-2018 at 07:33 AM.
 
Old 12-05-2018, 07:46 AM   #4
l0f4r0
Member
 
Registered: Jul 2018
Location: Paris
Distribution: Debian
Posts: 900

Rep: Reputation: 289Reputation: 289Reputation: 289
Quote:
Originally Posted by LBM View Post
But what does the "," do here ?
This comma is the one coming just before your IP, see:
Quote:
silvia,186.251.225.186
 
Old 12-05-2018, 07:56 AM   #5
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 113

Original Poster
Rep: Reputation: 1
Ah yes, of course!

Thanks again!

It seems to be working by setting it "non-greedy" as well, by using ? instead of ,.
Code:
dovecot.+?([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).+unknown user
 
Old 12-05-2018, 08:48 AM   #6
l0f4r0
Member
 
Registered: Jul 2018
Location: Paris
Distribution: Debian
Posts: 900

Rep: Reputation: 289Reputation: 289Reputation: 289
^Yes (because it's Perl), even better!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Cannot --enable-pcregrep-libbz2 because bzlib.h was not found nitishdola Linux - Newbie 1 12-20-2012 09:59 AM
[SOLVED] Weird awk behaviour with NOT regexp switch sarenace Programming 7 05-18-2012 01:54 AM
javascript regexp - strange exec behaviour, or space matching? jkobrien Programming 3 08-20-2008 08:09 AM
Odd behaviour when copying files from cdrom to hard drive... pdmackenzie Linux - Hardware 9 03-21-2003 07:34 PM
Very odd CPAN behaviour! bluehz Linux - Software 0 07-08-2002 05:59 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 02:07 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration