www.m00nie.com

Cisco pipe options and some regex examples

moonie -

Just a quick post about using the pipe (|) command on Cisco devices to help format the output of any command.

Add the pipe to any show command then ? can show the available options. Below is from a 6500.

6509#show run | ?
  append    Append redirected output to URL (URLs supporting append operation only)
  begin     Begin with the line that matches
  exclude   Exclude lines that match
  include   Include lines that match
  redirect  Redirect output to URL
  tee       Copy output to URL
  • Append will send all output from the show command to be appended to a file already created at either a local (flash: disk:) or remote (ftp: tftp:) location. E.g. the command below would copy the output off the show running-config command to an ftp server using a username and pass.
6509#show run | append ftp://myuser:mypass@10.10.10.10/6509/running_config
  • Begin well begin the output from the first line that matches the expression that follows the begin command. E.g the command below begins the output from eigrp router and outputs everything after that line  because its the first line to match our expression. Note that capitalisation does matter
6509#show run | begin router
router eigrp 1
 redistribute static
 network 10.0.0.0
 ...
 ntp server 10.20.10.2 source Vlan378
 end
  • Exclude removes all lines that match the expression from the output. E.g This will remove all lines beggining with a capital G (all GigabitEthernet interfaces) while showing all other lines.
6509#  show ip int brief | exclude ^G
Interface                  IP-Address      OK? Method Status                Protocol
Vlan1                      10.10.10.2      YES NVRAM  up                    up
Vlan2                      10.10.20.2      YES NVRAM  up                    up
...
Port-channel2              unassigned      YES unset  up                    up
Loopback0                  unassigned      YES NVRAM  up                    up
  • Include only displays the lines matching the expression. E.g This will only display lines starting with a capital G or a I.
6509#  show ip int brief | include ^(G|I)
Interface                  IP-Address      OK? Method Status                Protocol
GigabitEthernet1/1         unassigned      YES unset  up                    up
GigabitEthernet1/2         unassigned      YES unset  down                  down
...
GigabitEthernet7/48        unassigned      YES unset  down                  down
  • Redirect sends all output to a file that can be either local or remote similar to append but redirect either creates a new file or overwrites an existing one. E.g. This will send the output to a local file on disk0 (there is no terminal output from this command).
6509#show access-lists | redirect disk0:acls
  • Tee similar to append and redirect but also sends the output to the terminal. The default is similar to redirect (create new or overwrite) and to display to terminal although append behaviour (append to existing file) can be enabled with the /append switch. E.g This will append the output to a file on a tftp server and display the output to the terminal too.
6509# show access-list | tee /append tftp://10.10.10.10/6509/acl

Regex

The expressions for the commands above can either be simple words or regular expressions.  There are lots of sites about regex but here are a few examples. 
6509#show int | include ^[A-Z]
Vlan1 is up, line protocol is up
Vlan2 is up, line protocol is up
...
Loopback0 is up, line protocol is up
Shows all lines that begin with a capital letter. Will not match lines that start with a space. ^ Matches the start of a line and [A-Z] matches all capital letters. 
6509#show int | include ^[A-Z]|Last in
Vlan1 is up, line protocol is up
  Last input 00:00:00, output 00:00:01, output hang never
Vlan2 is up, line protocol is up
  Last input 00:00:01, output 00:00:00, output hang never
...
Loopback0 is up, line protocol is up
  Last input never, output never, output hang never
The example above macthes the same as the first example OR and line that includes "Last in". The second | enables the or function and "Last in" literally matches any occurrence of that phrase. Capitalisation does matter! 
m00nie-ASA# show processes cpu-usage sorted | include [0-9][0-9]\.|08bdbd11
081ae324   d59cf870    24.3%    25.6%    25.4%   Dispatch Unit
08bdbd11   d59c7098     0.0%     0.0%     0.0%   tcp_fast
On an ASA this time. This example matches two digits from 0-9 followed by a dot. The \ before the dot makes it match the literal dot. Again we use a second pipe for an or function and match a specific word. 
m00nie-ASA# show processes cpu-usage sorted | exclude 0.0%.*0.0%.*0.0%|[0-9][0-9]\.
PC         Thread       5Sec     1Min     5Min   Process
08bd08e6   d59a9110     0.8%     0.9%     0.9%   Logger
08b9dc8c   d59994e8     0.2%     0.2%     0.1%   ssh
083x1452   d59a23d8     0.1%     0.1%     0.1%   fover_health_monitoring_thread
This time we exclude all lines that have 0.0% 0.0% 0.0% OR have two digits followed by a dot ie. >= 10%. 
m00nie-ASA# show access-list | inc 192.168.1[5-9].*cnt=0
  access-list FW_ACL_Outside line 4 extended permit ip 192.168.16.0 255.255.255.0 any (hitcnt=0) 0xfd96397
  access-list FW_ACL_Outside line 4 extended permit ip 192.168.17.0 255.255.255.0 any (hitcnt=0) 0x4dd97bd
There is no "real" AND function but you can use .* (dot then star) to match everything between two other expressions. Above we match acls from 192.168.15-19.x AND that have a hit count of zero.

Regex can be very powerful when used with alias ;) A good place to practice is on the public route servers with a command like

show ip bgp regex "some expression"

m00nie :D