Cisco pipe options and some regex examples
Just a quick post about using the pipe (|) command on Cisco devices to help format the output of any command.
Add the pipe to any show command then ? can show the available options. Below is from a 6500.
6509#show run | ? append Append redirected output to URL (URLs supporting append operation only) begin Begin with the line that matches exclude Exclude lines that match include Include lines that match redirect Redirect output to URL tee Copy output to URL
- Append will send all output from the show command to be appended to a file already created at either a local (flash: disk:) or remote (ftp: tftp:) location. E.g. the command below would copy the output off the show running-config command to an ftp server using a username and pass.
6509#show run | append ftp://myuser:firstname.lastname@example.org/6509/running_config
- Begin well begin the output from the first line that matches the expression that follows the begin command. E.g the command below begins the output from eigrp router and outputs everything after that line because its the first line to match our expression. Note that capitalisation does matter
6509#show run | begin router router eigrp 1 redistribute static network 10.0.0.0 ... ntp server 10.20.10.2 source Vlan378 end
- Exclude removes all lines that match the expression from the output. E.g This will remove all lines beggining with a capital G (all GigabitEthernet interfaces) while showing all other lines.
6509# show ip int brief | exclude ^G Interface IP-Address OK? Method Status Protocol Vlan1 10.10.10.2 YES NVRAM up up Vlan2 10.10.20.2 YES NVRAM up up ... Port-channel2 unassigned YES unset up up Loopback0 unassigned YES NVRAM up up
- Include only displays the lines matching the expression. E.g This will only display lines starting with a capital G or a I.
6509# show ip int brief | include ^(G|I) Interface IP-Address OK? Method Status Protocol GigabitEthernet1/1 unassigned YES unset up up GigabitEthernet1/2 unassigned YES unset down down ... GigabitEthernet7/48 unassigned YES unset down down
- Redirect sends all output to a file that can be either local or remote similar to append but redirect either creates a new file or overwrites an existing one. E.g. This will send the output to a local file on disk0 (there is no terminal output from this command).
6509#show access-lists | redirect disk0:acls
- Tee similar to append and redirect but also sends the output to the terminal. The default is similar to redirect (create new or overwrite) and to display to terminal although append behaviour (append to existing file) can be enabled with the /append switch. E.g This will append the output to a file on a tftp server and display the output to the terminal too.
6509# show access-list | tee /append tftp://10.10.10.10/6509/acl
RegexThe expressions for the commands above can either be simple words or regular expressions. There are lots of sites about regex but here are a few examples.
6509#show int | include ^[A-Z] Vlan1 is up, line protocol is up Vlan2 is up, line protocol is up ... Loopback0 is up, line protocol is upShows all lines that begin with a capital letter. Will not match lines that start with a space. ^ Matches the start of a line and [A-Z] matches all capital letters.
6509#show int | include ^[A-Z]|Last in Vlan1 is up, line protocol is up Last input 00:00:00, output 00:00:01, output hang never Vlan2 is up, line protocol is up Last input 00:00:01, output 00:00:00, output hang never ... Loopback0 is up, line protocol is up Last input never, output never, output hang neverThe example above macthes the same as the first example OR and line that includes "Last in". The second | enables the or function and "Last in" literally matches any occurrence of that phrase. Capitalisation does matter!
m00nie-ASA# show processes cpu-usage sorted | include [0-9][0-9]\.|08bdbd11 081ae324 d59cf870 24.3% 25.6% 25.4% Dispatch Unit 08bdbd11 d59c7098 0.0% 0.0% 0.0% tcp_fastOn an ASA this time. This example matches two digits from 0-9 followed by a dot. The \ before the dot makes it match the literal dot. Again we use a second pipe for an or function and match a specific word.
m00nie-ASA# show processes cpu-usage sorted | exclude 0.0%.*0.0%.*0.0%|[0-9][0-9]\. PC Thread 5Sec 1Min 5Min Process 08bd08e6 d59a9110 0.8% 0.9% 0.9% Logger 08b9dc8c d59994e8 0.2% 0.2% 0.1% ssh 083x1452 d59a23d8 0.1% 0.1% 0.1% fover_health_monitoring_threadThis time we exclude all lines that have 0.0% 0.0% 0.0% OR have two digits followed by a dot ie. >= 10%.
m00nie-ASA# show access-list | inc 192.168.1[5-9].*cnt=0 access-list FW_ACL_Outside line 4 extended permit ip 192.168.16.0 255.255.255.0 any (hitcnt=0) 0xfd96397 access-list FW_ACL_Outside line 4 extended permit ip 192.168.17.0 255.255.255.0 any (hitcnt=0) 0x4dd97bdThere is no "real" AND function but you can use .* (dot then star) to match everything between two other expressions. Above we match acls from 192.168.15-19.x AND that have a hit count of zero.
Regex can be very powerful when used with alias ;) A good place to practice is on the public route servers with a command like
show ip bgp regex "some expression"