How to copy a specific portion from the log file ?

In response to a question I asked in AskUbuntu forum I needed to post the log file of the BitDefender Scan. The log file size was huge with information of each file scanned. I needed only those lines which had Virus or Trojan Detected. So my objective was to copy only those lines  from the log into a new file and post the content of that file. How to do this ?

Method 1: Grep Method
First I detected a common word in all the lines that I don’t want.
The word “ok” indicates that the file was not infected and the word “password protected” indicates that the file was not scanned as it was password protected.
Then I used the grep invert switch (“-v”) which matches all the lines which don’t have the above words. And I redirected the output to a new file using “>”.

user@linux$ grep -vwE "(ok|password protected)" bdscan.log > trimmed_bdscan.log

Note here that “-w” matches the whole words “ok” and “password protected”, not the words alok or passcode. The “-E” switch is needed to enable the Extended Regular Expression (regex) for the (ok|password protected) syntax.
Counting the number of lines in bdscan.log and trimmed_bdscan.log showed a drastic difference.

user@linux$ wc -l bdscan.log trimmed_bdscan.log
618387 bdscan.log
    50 trimmed_bdscan.log

Method 2: Sed Method
Alternatively, to remove the lines in-place you can use “sed -i”

user@linux$ sed -i "/\b\(ok\|"password protected"\)\b/d" filename

The “\b” sets the word boundaries and the “d” operation deletes the lines matching the regex between the forward slashes. “ok” and “password protected” both are matched by the (ok|password protected) syntax. We need to escape with backslashes, apparently.
Tip: Use sed without “-i” so you can test the output of the command before overwriting the file.

You can use AWK also. If you know other methods of doing, please share them in the comments section.

About Deepak Devanand

Seeker of knowledge
This entry was posted in Linux and tagged , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s