Force10 - Grep and Advanced Grep in FTOS

Working with large outputs in the CLI can be daunting and overwhelming. To reduce the amount of information, and focus on the important data, you can use the ‘grep’ command to reduce the amount of output from a given command.

In FTOS, there are 5 ‘pipe’ commands that can be used to modify or alter the way output is presented or handled:

find -  Outputs only the first instance of a given argument. Useful for items that should only appear once, such as a particular MAC/IP when showing the ARP or MAC address tables

no-more – Outputs all data at once, with no prompts to advance to the next page of text. Useful when logging is enabled in your terminal emulator client and you are saving large dumps (e.g. ‘show tech-support’)

save – Directs the output of the command to a specified local or remote file. Does not print to client screen

The remaining two provide more fine control over outputs than the above, and can be chained together for very powerful search capability:

            grep – Outputs all lines that contain the given string or strings

except – Basically an inverse ‘grep’. Outputs all lines not containing the given string or strings

By first determining what information you wish to view, you can then determine which commands, or chains of commands, you will want to use to pare down your output data.

A common use scenario is to get an at a glance overview of port congestion statistics. To view interface statistics you would normally use "show interfaces <optionally specify specific single interface) and would have to pick through the output for the relevant congestion statistics, see below with interesting lines highlighted in red:

S4810-17#show interface tengigabitethernet 0/0

TenGigabitEthernet 0/0 is up, line protocol is up

Hardware is DellEth, address is 00:01:e8:8b:14:89

    Current address is 00:01:e8:8b:14:89

Pluggable media present, SFP+ type is 10GBASE-SR

    Medium is MultiRate, Wavelength is 850nm

    SFP+ receive power reading is 0.8465dBm

Interface index is 17105922

Internet address is not set

Mode of IPv4 Address Assignment : NONE

DHCP Client-ID :0001e88b1489

MTU 12000 bytes, IP MTU 11982 bytes

LineSpeed 10000 Mbit

Flowcontrol rx off tx off

ARP type: ARPA, ARP Timeout 04:00:00

Last clearing of "show interface" counters 2w4d2h

Queueing strategy: fifo

Input Statistics:

     50184 packets, 3211776 bytes

     50184 64-byte pkts, 0 over 64-byte pkts, 0 over 127-byte pkts

     0 over 255-byte pkts, 0 over 511-byte pkts, 0 over 1023-byte pkts

     50184 Multicasts, 0 Broadcasts

     0 runts, 0 giants, 0 throttles

     0 CRC, 0 overrun, 0 discarded

Output Statistics:

     50398 packets, 3225472 bytes, 0 underruns

     50398 64-byte pkts, 0 over 64-byte pkts, 0 over 127-byte pkts

     0 over 255-byte pkts, 0 over 511-byte pkts, 0 over 1023-byte pkts

     50398 Multicasts, 0 Broadcasts, 0 Unicasts

     0 throttles, 0 discarded, 0 collisions, 0 wreddrops

Rate info (interval 299 seconds):

     Input 00.00 Mbits/sec,          0 packets/sec, 0.00% of line-rate

     Output 00.00 Mbits/sec,         0 packets/sec, 0.00% of line-rate

Time since last interface status change: 2w4d2h

Since the vast majority of the output is unnecessary information, it saves time (both in waiting for the information to output, and finding the relevant information amongst the immaterial) to cut down what is output to the information we actually care about.

The key is to find unique strings that are only present on the lines you care about. Multiple strings – where your output will be all lines with any of the given strings – are indicated by separating the strings with a pipe ("|") character. Strings containing spaces must be enclosed in double-quotes. Ex:

S4810-17#show interface tengigabitethernet 0/0 | grep Ethernet|throttle|%

TenGigabitEthernet 0/0 is up, line protocol is up

     0 runts, 0 giants, 0 throttles

     0 throttles, 0 discarded, 0 collisions, 0 wreddrops

     Input 00.00 Mbits/sec,          0 packets/sec, 0.00% of line-rate

     Output 00.00 Mbits/sec,         0 packets/sec, 0.00% of line-rate

How about instances where your desired string is present in lines that you do not want to include. For example, when checking the configuration of all interfaces to determine if they have an IP address assigned – the interface configuration will either have the line ‘no ip address’ or ‘ip address X.X.X.X/Y’. Since ‘.’ cannot by grepped (‘.’ matches any character) and ‘/’ can match multiple other configuration lines, you will want to create an initial grep argument to pare down the output, and then direct that output through a secondary grep to weed out false positives. Ex:

Not Unique Enough –

S4810-17#show running-config interface | grep Ethernet|address

interface TenGigabitEthernet 0/0

 no ip address

interface TenGigabitEthernet 0/1

 no ip address

<…>

interface TenGigabitEthernet 0/46

 no ip address

interface TenGigabitEthernet 0/47

 no ip address

 interface ManagementEthernet 0/0

 ip address 192.168.44.109/22

Secondary grep focuses on a unique string in the initial grep output -

S4810-17#$ning-config interface | grep Ethernet|address | grep Ethernet|/

interface TenGigabitEthernet 0/0

<…>

interface TenGigabitEthernet 0/46

interface TenGigabitEthernet 0/47

interface ManagementEthernet 0/0

 ip address 192.168.44.109/22

The ‘except’ command

The ‘except’ command is essentially the same as grep but performed in reverse. By its nature this will generally have larger outputs than grep if used as the initial operand, but it is powerful when understood and used properly. The most useful implementation of except is when pairing down a grep output that used more common strings – especially when trying to weed out lines that contain the same strings as a target line plus additional strings. For example, if you wished to see all interfaces that were in ‘protocol down’ state but only of one interface type, you could:

S4810-17#show interfaces | grep "protocol is down" | except Vlan|GigE

Which will exclude mention of the Forty gigabit interfaces as well as the VLAN interfaces

Sequential pipe commands can be chained indefinitely to fine-tune command outputs. Note that exceptionally long commands, should they fail with a syntax error, will not point to the correct portion of the command which has the incorrect syntax.