#grep

14 one-liners with this tag.

Analyze Googlebot requests in the access log

#grep -i "googlebot" /var/www/vhosts/system/example.com/logs/access_ssl_log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20

Check whether Apache hit MaxRequestWorkers

#grep -i "MaxRequestWorkers" /var/log/apache2/error.log* | tail -20

Extract all URLs from a sitemap.xml

$curl -s https://example.com/sitemap.xml | grep -oP '(?<=<loc>)[^<]+' | sort -u

harmlessSEO checks

Find a hacked mail account by its SMTP logins

#grep -o "sasl_username=[^ ,]*" /var/log/maillog | sort | uniq -c | sort -rn | head -20

Find out which cron job runs a command

#grep -rn "wp-cron.php" /etc/crontab /etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs 2>/dev/null

Find permanently rejected emails in the mail log

#grep "status=bounced" /var/log/maillog | tail -n 20

Find the cause of a 502 Bad Gateway in the nginx log

#grep -E "upstream|connect\(\) failed" /var/log/nginx/error.log | tail -20

Follow a log file live and filter by keywords

#tail -f /var/log/syslog | grep --line-buffered -iE "error|warn|fail"

Search for text in all files of a directory

$grep -rnI --include='*.php' 'base64_decode' /var/www/vhosts/example.com/httpdocs

harmlessFilesystem

Search for text in all versions of a repository

$git rev-list --all | xargs git grep -F 'DB_PASSWORD'

Search PHP files for typical malware patterns

$grep -rlE --include='*.php' 'eval\((base64_decode|gzinflate|gzuncompress|str_rot13)\(' /var/www/vhosts/example.com/httpdocs

harmlessSecurity

Show a config file without comments and blank lines

$grep -Ev '^\s*(#|;|$)' /etc/php/8.2/fpm/php.ini

harmlessText processing

Trace delivery for an email address in the mail log

#grep -i "info@example.com" /var/log/maillog | tail -n 50

Trace local PHP mail sending to a system user

#grep "postfix/pickup" /var/log/maillog | grep -o "uid=[0-9]*" | sort | uniq -c | sort -rn | head -10