Get results from grep in the order they appear

grepshellunix-shell

I'm trying to grep a log file to only show lines that match a certain session ID. Thus far, it works great. However, when I get the results of my grep command, I'm not getting the entries in the order they appear.

If the log file in the directory has this data:

SESSNUM=4437 login.jsp
SESSNUM=4437 welcome.jsp
SESSNUM=4437 info.jsp
SESSNUM=4437 logout.jsp

And I enter this:

grep SESSNUM=4437 *

I get this information:

SESSNUM=4437 logout.jsp
SESSNUM=4437 welcome.jsp
SESSNUM=4437 login.jsp
SESSNUM=4437 info.jsp

Is there a way to make grep display matching lines in the order they appear in the log file(s)?

Thanks!
IVR Avenger

Best Answer

grep SESSNUM=4437 *

Grep normally returns thing in order. Are you sure you are getting the results from the correct log file? Does it work correctly if you specify the logfile you want instead of just *?

Correction! There should only be one file in the directory that contains the session number, but I don't necessarily know which one when I'm grepping.

I would suggest you use the -H option of grep, so you can be sure you are getting the content from only one file. This should be the default behavior, but what you posted didn't include the filenames, unless you stripped those out.

   -H, --with-filename
          Print the file name for each match.  This is  the  default  when
          there is more than one file to search.

Some Background:

The setuid bit:
The setuid bit on a executable file makes it so executables that are run by any user, are run as if they were being run by the owner of the executable. So if setuid is set on a program that is owned by root, no matter who runs it, it will be run with root privileges. It is of course not that simple, see this wikipedia article, or get a copy of Steven's Programing in the Unix Environment.

A Core Dump:
A core dump is a dump of the program's working memory to a file. See this wikipedia article.

suid_dumpable:
This controls if the core can be dumped from a setuid program as described above. See below. This is a kernel tunable, you can change it with:

sudo sysctl -w kernel.suid_dumpable=2

You would find out about this tunable in documentation for your sourcode, which if installed, you might find in a directory like: /usr/src/linux-source-2.6.27/Documentation/sysctl/ . In this case, the reference below is in fs.txt in that directory. Use the uname -a command to find out your kernel version.

Why it Matters:

It could be a security risk:
So the idea is, if there are core dumps and a regular user can read them, they might find out privileged information. If the program is dumped well it had privileged information in memory, and the user can read the dump, they might find out that privileged information.

Reference:

This value can be used to query and set the core dump mode for setuid
or otherwise protected/tainted binaries. The modes are

0 - (default) - traditional behaviour. Any process which has changed
   privilege levels or is execute only will not be dumped
1 - (debug) - all processes dump core when possible. The core dump is
   owned by the current user and no security is applied. This is
   intended for system debugging situations only.
2 - (suidsafe) - any binary which normally not be dumped is dumped
   readable by root only. This allows the end user to remove
   such a dump but not access it directly. For security reasons
   core dumps in this mode will not overwrite one another or 
   other files. This mode is appropriate when adminstrators are
   attempting to debug problems in a normal environment.

Linux – Send email based on grep results

Take a look to this answer echo based on grep result
It's almost the same, take the answer that better fit your need then suppress the echo No part and remplace the echo yes part by an email command

Regading leading and trailing characters you can use -C options or -A and -B (-C is -A X -B X)

   -A NUM, --after-context=NUM
          Print NUM lines of trailing context after matching lines.  Places a line containing -- between contiguous groups of matches.


   -B NUM, --before-context=NUM
          Print NUM lines of leading context before matching lines.  Places a line containing -- between contiguous groups of matches.

   -C NUM, --context=NUM
          Print NUM lines of output context.  Places a line containing -- between contiguous groups of matches.

if I understand what you want to do, you might like the following exemple

perl webinject.pl > /tmp/webinject_result.txt
if grep --quiet 'TEST CASE FAILED' /tmp/webinject_result.txt;
then
  grep -B 20 -B 2 'TEST CASE FAILED' /tmp/webinject_result.txt | mail someone@domain.tld
fi

Best Answer

Related Solutions

Bash – On Redhat, what does “kernel.suid_dumpable = 1” mean

Some Background:

Why it Matters:

Reference:

Linux – Send email based on grep results

Related Topic