Use of watch and lsof + grep together [duplicate] - grep

This question already has answers here:
The watch command does not work with a command using a pipe [closed]
(2 answers)
Closed 1 year ago.
When i use
lsof -p 3536693 | grep snapshot
I get an output
but if i try to
watch lsof -p 3536693 | grep snapshot
I get nothing. Aren't they compatible?
It works if I ommit grep, like
watch lsof -p 3536693

It works when the "watched" command is quoted, so:
watch "lsof -p 3536693 | grep snapshot"

Related

Check docker instance in Bash

Having docker ps -a
I want to match the NAMES VERSION and STATUS.
docker ps -a --format "{{.Image}}\t{{.Status}}" | awk -F$"\t" '{printf "%s|%s\n", $1, $2}'
Output:
registry.com/project/glass/glass_front:2.2.15.4|Up 6 days
registry.com/project/glass/glass_proxy:2.2.15.4|Up 6 days
registry.com/project/glass/glass_modeles_front:2.1.5.2|Up 6 days
How can i modify my command to have this:
glass_front | 2.2.15.4 | Up 6 days
glass_proxy | 2.2.15.4 | Up 6 days
glass_modeles_front| 2.1.5.2 | Up 6 days
Try using colon as the separator in the docker ps command, then use sed to transform the colon to pipe and remove the prefix:
docker ps -a --format "{{.Image}}:{{.Status}}" \
| sed -e 's/:/ | /g' -e 's,^.*/,,'
Could you please try following, not tested it as don't have docker command. Its based on completely shown sample output of OP only.
docker ps -a --format "{{.Image}}\t{{.Status}}" \
| awk -F'\t' '{num=split($1,arr,"[/:]");print arr[num-1],arr[num],$2}'
OR(only using field separator capability of awk)
docker ps -a --format "{{.Image}}\t{{.Status}}" \
| awk -F"[/:\t]" '{print $4,$5,$NF}'
Explanation(1st solution): Running docker program(what OP shown) then passing its output as an input to awk command. In awk command setting field separator as TAB. Then splitting 1st field into an array(arr) with delimiter of /,:, then finally printing arr's 2nd last and last items here with 2nd field of current line.

can not passed for argument into awk [closed]

Closed. This question is not reproducible or was caused by typos. It is not currently accepting answers.
This question was caused by a typo or a problem that can no longer be reproduced. While similar questions may be on-topic here, this one was resolved in a way less likely to help future readers.
Closed 2 years ago.
Improve this question
I want to remove all containers at once with awk, but after running this code I got an empty line and no any argument passed to the docker.
for i in {1..3}; do docker container rm -f `docker ps -a | awk -v i=$i++ 'NR==i {print $1}'`; done'
The solution you posted yourself is absurd. Just
docker ps -a -q |
xargs -n 1 docker container rm -f
Less compactly, you could say
docker ps -a -q |
while read -r id; do
docker container rm -f "$id"
done
The -q option to docker ps causes it to only list the container's id, without the chaff you apparently figured out you wanted to remove with Awk.
Expressing shell logic as pipelines is often very succinct, natural, and quick; thinking you somehow need to know how many of something you have before you can loop over them is a rather common beginner antipattern.
If there could be more than three containers and you always want to kill the first three, you can add head -n 3 in the obvious place; though this too seems like a potentially grave beginner mistake - you have no direct control over in which order docker ps will list things. A much better approach then would be to pass in a --filter argument to docker ps to select only exactly the ones which (are yours and which also) meet some filtering criterion.
<shellcheck.net> correct my issue
thanks https://stackoverflow.com/users/1745001/ed-morton
for i in {1..3}; do docker container rm -f $(docker ps -a | awk -v i="$i" 'NR==i {print $1}'); done

Docker ps -a sort by date

docker ps sorts by time, but the most recent docker instance is at the very top. This means if you started very many instances you have to scroll all the way to the top to see them. How do we output "docker ps -a" in reverse order, so that the most recent instance is printed at the bottom?
You can pipe the output to tac[1] like:
docker ps -a | tac
[1] From man tac: tac - concatenate and print files in reverse
Latest created container:
docker ps -a -l
Latest 5 created containers:
docker ps -a -n 5
As far as I know ordering is not possible but maybe you don't really need it...
It's enough to get what you want.
$ docker ps -a --format "table {{.ID}}\t{{.Names}}\t{{.CreatedAt}}" | (read -r; printf "%s\n" "$REPLY"; sort -k 3 -r )
See also
How to sort or order results docker ps --format?

pipe tcpdump output to grep multiline pattern

I want to grep a multiline pattern from tcpdump output like the following:
sudo tcpdump -A -s0 | grep -Pzo 'foo.*\n.*bar'
However, it does not seem to work. But it works if I dump the data into a file and then grep the file. How can I make the command using pipe working?
Try to add -l:
-l Make stdout line buffered. Useful if you want to see the data while capturing it.
E.g.,
tcpdump -l | tee dat
tcpdump -l > dat & tail -f dat
I still don't get why the grep does not work above even with -l option for tcpdump, but I found this stackoverflow post How to find patterns across multiple lines using grep?. So I tried pcregrep, and it worked.
sudo tcpdump -A -s0 | pcregrep -Mo "foo.*\n.*bar"
I was having problems piping the output to tail even with the -l switch as well. I was able to solve my problem by using multitail instead of tail -F.
This worked for me: multitail -l "tcpdump -li eth0"

Combining many greps in a single grep call

I've a script where I've to check if a process is running by its name and I'm doing it using ps and grep. The problem is that I've to grep many things to avoid to find false positive.
By now, I've a grep chain that looks as follow:
ps -ef | grep -i $process_name | grep -i perl | grep -v do_all | grep -v grep
Four greps. Three of them are there to avoid false positive.
I would like to know if there's a way to avoid such 'piping chain' and use a single grep to achieve the same result.
Though some of you could answer that there are cleaner way to find out if a process exists, I would like the same to have an answer to this question, just to better understand the usage of the grep command.
There's no real reason to avoid chaining them, is there?
If you really wanted to you could combine them with | in egrep:
ps -ef | egrep -i "$process_name|perl" | egrep -v 'do_all|grep'
Here's one way using GNU awk:
ps -ef | awk -v process="$process_name" 'BEGIN { IGNORECASE=1 } $0 ~ process && /perl/ && !/do_all/'

Resources