How to use grep in way, where I can only get the word I want from a textfile?

Question

I am trying to grep /var/log/secure to find the unique IP addresses that tried to use my instance. Every time, I try to grep I get the lines where the IP is located. How can I grep in a way where I just get the IP I want and store it in a text file. I'll post examples to clarify what I am looking for.

This is a sample /var/log/secure file:

Oct  9 22:45:48 ip-172-26-14-23 sshd[18080]: Disconnected from 34.101.251.82 port 59344 [preauth]
Oct  9 22:46:41 ip-172-26-14-23 sshd[18082]: Did not receive identification string from 209.17.97.18 port 64550
Oct  9 22:47:23 ip-172-26-14-23 sshd[18083]: Connection closed by 74.120.14.52 port 44578 [preauth]
Oct  9 22:54:03 ip-172-26-14-23 sshd[18088]: Invalid user cisco from 106.13.233.5 port 44180
Oct  9 22:54:03 ip-172-26-14-23 sshd[18088]: input_userauth_request: invalid user cisco [preauth]
Oct  9 22:54:03 ip-172-26-14-23 sshd[18088]: Received disconnect from 106.13.233.5 port 44180:11: Bye Bye [preauth]
Oct  9 22:54:03 ip-172-26-14-23 sshd[18088]: Disconnected from 106.13.233.5 port 44180 [preauth]
Oct  9 22:56:53 ip-172-26-14-23 sshd[18090]: reverse mapping checking getaddrinfo for reaia.tumblles.com [141.98.9.32] failed - POSSIBLE BREAK-IN ATTEMPT!
Oct  9 22:56:54 ip-172-26-14-23 sshd[18090]: Connection closed by 141.98.9.32 port 34537 [preauth]
Oct  9 22:56:57 ip-172-26-14-23 sshd[18092]: reverse mapping checking getaddrinfo for kei.tumblles.com [141.98.9.33] failed - POSSIBLE BREAK-IN ATTEMPT!

So what I want is to grep var/log/secure and just print the unique ips that tried to use my instance in a textfile like this:

**Desired output:**
34.101.251.82
74.120.14.52
106.13.233.5
141.98.9.32
So on....
I might have missed some but you get the idea.

when I try to grep the file with the command: sudo grep 'from' /var/log/secure | awk {print $2} > ips.out. I get the following output to the file.

9
9
9
9
9
9
9
so on....

9 is the date The ideology behind the input is that the word "from" is next to the ip address. So grep should go there and print the word next it with awk{print $2}.

However, I want to extract all IPS from anywhere in the file, not just the IPS after "from". What I did above is the only way I could do it at the moment. I was thinking to run multiple commands and make a bash script that gets Ips from all locations.

PS: I only want IPs after from!

Please add sample input (no descriptions, no images, no links) and your desired output for that sample input to your question (no comment). — Cyrus, Oct 09 '20 at 23:36
please update the question to show a sample of the (complete) lines from `/var/log/secure` (would suggest a few lines you expect to match and a few lines that won't match), and then provide the expected output (corresponding to said sample lines) — markp-fuso, Oct 09 '20 at 23:48
why doesn't `209.17.97.18` show up in your expected output (it's prefaced with the string `'from'`)? why is `141.98.9.32` in the expected output since the line it resides on does not include the string `'from'`? please update your expected output to correspond with the sample lines you've posted — markp-fuso, Oct 10 '20 at 00:01
See: [How do you extract IP addresses from files using a regex in a linux shell?](https://stackoverflow.com/q/427979/3776858) — Cyrus, Oct 10 '20 at 00:15
I have assumed you want only the IPs after `from `, not in brackets or any other IPs appearing in your logs, based on your description, if this is not enough, update with more details. — thanasisp, Oct 10 '20 at 00:20

thanasisp · Accepted Answer · 2020-10-10T01:06:08.640

2

You can do it using positive look behind with grep, you have to use -P for Perl-compatible regular expressions, also -o prints only the matched string.

> grep -Po "(?<=from )[0-9]{1,3}(\.[0-9]{1,3}){3}" file
34.101.251.82 
209.17.97.18 
106.13.233.5 
106.13.233.5 
106.13.233.5

The initial part inside parentheses, the "from ", will be first matched, but ignored for the -o option, only the part after that will be considered.

This part is a simple expression to match an IP, meaning:

[0-9]{1,3}     (\.       [0-9]{1,3}) {3}
1-3 digits and (dot with 1-3 digits) {3 times more}

that's 4 numbers with maximum 3 digits, separated by dots.

See more about matching an IP into this question

edited Oct 10 '20 at 01:06

answered Oct 10 '20 at 00:06

thanasisp

5,855
3
14
31

can you explain me [0-9]{1,3}(\.[0-9]{1,3}){3}" – Needyboy2 Oct 10 '20 at 00:32
I have updated the answer with some more explanations, I hope it's useful. – thanasisp Oct 10 '20 at 00:45

score 1 · Answer 2 · answered Oct 10 '20 at 04:31

1

Based on shown samples only, could you please try following, written and tested in following link https://ideone.com/bQGspU

awk '
BEGIN{
  FS="from[[:space:]]+|[[:space:]]+port"
}
$2~/^[0-9]{1,3}(\.[0-9]{1,3}){3}$/{
  print $2
}
' Input_file

answered Oct 10 '20 at 04:31

RavinderSingh13

130,504
14
57
93

score 1 · Answer 3 · answered Oct 10 '20 at 07:35

with GNU awk multi-char RS

awk -v RS="[0-9]{1,3}[.][0-9]{1,3}[.][0-9]{1,3}[.][0-9]{1,3}" 'RT{print RT}' file

34.101.251.82
209.17.97.18
74.120.14.52
106.13.233.5
106.13.233.5
106.13.233.5
141.98.9.32
141.98.9.32
141.98.9.33
141.98.9.33

and the uniq command removes the adjacent duplicate lines

$ awk -v RS="[0-9]{1,3}[.][0-9]{1,3}[.][0-9]{1,3}[.][0-9]{1,3}" 'RT{print RT}' file | uniq
34.101.251.82
209.17.97.18
74.120.14.52
106.13.233.5
141.98.9.32
141.98.9.33

How to use grep in way, where I can only get the word I want from a textfile?

3 Answers3