Wired Intelligent Edge (Campus Switching and Routing)

How To Find Or Exclude Data In The Show Commands On HPE/Aruba AOS Switches

MVP Expert
MVP Expert
Q:

How can we search for, or exclude, specific data from the "show..." commands at the switch CLI?



A:

How to find or exclude specific information using "show" commands at the switch CLI.

This article shows examples of how we can use the "include" and "exclude" options to help find more specific information using the "show" commands.

After entering a "show" command, we can use the | (pipe) symbol and then use "i" for include or "e" for exclude, to help limit the information we are searching for.

Here are some examples on how the Include may be useful.
We will look at interface statistics for port A1 on a 5400zl switch.
Normally we would type the command "show interface a1" to view this information:

5400-1_5406zl# show int a1

 Status and Counters - Port Counters for port A1

  Name  :
  MAC Address      : 345678-901234
  Link Status      : Up
  Totals (Since boot or last clear) :
   Bytes Rx        : 2,065,074,839      Bytes Tx        : 242,623,617
   Unicast Rx      : 739,358            Unicast Tx      : 852,479
   Bcast/Mcast Rx  : 24,635,321         Bcast/Mcast Tx  : 180,733
  Errors (Since boot or last clear) :
   FCS Rx          : 0                  Drops Tx        : 0
   Alignment Rx    : 0                  Collisions Tx   : 0
   Runts Rx        : 0                  Late Colln Tx   : 0
   Giants Rx       : 0                  Excessive Colln : 0
   Total Rx Errors : 0                  Deferred Tx     : 0
  Others (Since boot or last clear) :
   Discard Rx      : 0                  Out Queue Len   : 0
   Unknown Protos  : 0
  Rates (5 minute weighted average) :
   Total Rx  (bps) : 503,952            Total Tx  (bps) : 503,896
   Unicast Rx (Pkts/sec) : 1            Unicast Tx (Pkts/sec) : 1
   B/Mcast Rx (Pkts/sec) : 1            B/Mcast Tx (Pkts/sec) : 0
   Utilization Rx  : 00.50 %            Utilization Tx  : 00.50 %


If we only want to view the Broadcast information for port A1, we can use the "| i Bcast" after the command to only view Broadcast information:

*Note - Entries are Case-Sensitive when using the Include/Exclude options.  We must enter them with the same syntax and capitalization as the original output shows.
Example:  We must use "Bcast" and not "bcast" for the output to show correctly.

5400-1_5406zl# show int a1 | i Bcast
   Bcast/Mcast Rx  : 24,635,357         Bcast/Mcast Tx  : 180,733


If we want to view both Broadcast and Unicast information, we can add "i Bcast|Unicast" to add multiple search entries.

5400-1_5406zl# show int a1 | i Bcast|Unicast
   Unicast Rx      : 739,499            Unicast Tx      : 852,628
   Bcast/Mcast Rx  : 24,635,446         Bcast/Mcast Tx  : 180,734
   Unicast Rx (Pkts/sec) : 4            Unicast Tx (Pkts/sec) : 4


Limiting this information may be useful, especially when we only want to see Broadcast information for hundreds of ports.
For example, if we type in "show interface all | i Bcast", this will only show the broadcast output for all ports.
We can add a search for "Port" and "Bcast" to show the port number followed by the broadcast output for each port.

5400-1_5406zl# show int all | i Port|Bcast
 Status and Counters - Port Counters for port A1
   Bcast/Mcast Rx  : 24,648,332         Bcast/Mcast Tx  : 180,840
 Status and Counters - Port Counters for port A2
   Bcast/Mcast Rx  : 19,332,174         Bcast/Mcast Tx  : 102,774
 Status and Counters - Port Counters for port A3
   Bcast/Mcast Rx  : 0                  Bcast/Mcast Tx  : 0
...


This can also be handy when trying to find specific entries in the event logs.
For example, If we want to check only for events related to the Power Supply, we could use the following command:
show log -a | i Power Supply

5400-1_5406zl# show log -a | i Power Supply
W 03/20/19 11:00:43 00576 chassis: 50V Power Supply 2 is Faulted. Failures: 1
W 04/23/19 11:41:02 00576 chassis: 50V Power Supply 2 is Faulted. Failures: 2
W 04/23/19 11:52:09 00576 chassis: 50V Power Supply 2 is Faulted. Failures: 3


Another way this can be useful when looking at the event logs, is to exclude certain data from the output.
For example, if the log is flooded with the same event message and we want to eliminate those entries from the output, we can use the "| e" command to exclude these entries.
In this example the log is filled with "High collision or drop rate" events:

W 04/24/19 21:21:37 00331 FFI: port C15-High collision or drop rate. See help.
W 04/25/19 03:24:05 00331 FFI: port C4-High collision or drop rate. See help.
W 04/25/19 03:35:04 00331 FFI: port C4-High collision or drop rate. See help.
W 04/25/19 03:43:50 00331 FFI: port B8-High collision or drop rate. See help.
W 04/25/19 04:59:28 00331 FFI: port A3-High collision or drop rate. See help.
I 04/25/19 05:33:33 03362 auth: User 'Admin' logged in from 192.168.1.12 to TELNET  session
W 04/25/19 09:30:02 00331 FFI: port B16-High collision or drop rate. See help.
W 04/25/19 09:41:01 00331 FFI: port B16-High collision or drop rate. See help.
W 04/25/19 09:56:09 00331 FFI: port A3-High collision or drop rate. See help.
W 04/25/19 10:30:29 00331 FFI: port B16-High collision or drop rate. See help.

We can use the "show log -a | e High collision" command to filter out the High collision entries from the output:

5400-1_5406zl# show log -a | e High collision
I 04/25/19 05:33:33 03362 auth: User 'Admin' logged in from 192.168.1.12 to TELNET  session
            

If we want to include or exclude multiple entries using the pipe option, we cannot use words within quotation marks.
For example, if we want to search the log for SSH and Telnet login entries, we can use the following command:
show log -a | i SSH|Telnet
(this will return log entries that contain SSH and Telnet)

When using the Pipe option, we cannot use quotes, or the search will not return any results for that output:
show log -a | i "SSH"|"Telnet"
(this will not return any results)


Another way to view specific event log entries is to search for a specific string of text using quotation marks after the "show log..." command.
This option does not use the Pipe option or the Include/Exclude options, and can only be used to search for one specific string of text.
For example if we want to search the event log for all events that occurred on "Slot C", we can use the following command:
show log -a "Slot C"

*Note - The text string within the quotation marks is also case sensitive and must match exactly as shown in the original output.

5400-1_5406zl# show log -a "Slot C"
 Keys:   W=Warning   I=Information
         M=Major     D=Debug E=Error
----  Event Log listing: All Events Recorded  ----
I 03/20/19 11:00:43 00068 chassis: Slot C Inserted
W 03/20/19 11:00:52 00274 chassis: Slot C self test failure or unsupported module

Version history
Revision #:
1 of 1
Last update:
‎06-25-2019 11:44 PM
Updated by:
 
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: