Q:
How can we search for, or exclude, specific data from the "show..." commands at the switch CLI?
A: How to find or exclude specific information using "show" commands at the switch CLI.
This article shows examples of how we can use the "include" and "exclude" options to help find more specific information using the "show" commands.
After entering a "show" command, we can use the | (pipe) symbol and then use "i" for include or "e" for exclude, to help limit the information we are searching for.
Here are some examples on how the Include may be useful.
We will look at interface statistics for port A1 on a 5400zl switch.
Normally we would type the command "show interface a1" to view this information:
5400-1_5406zl# show int a1
Status and Counters - Port Counters for port A1
Name :
MAC Address : 345678-901234
Link Status : Up
Totals (Since boot or last clear) :
Bytes Rx : 2,065,074,839 Bytes Tx : 242,623,617
Unicast Rx : 739,358 Unicast Tx : 852,479
Bcast/Mcast Rx : 24,635,321 Bcast/Mcast Tx : 180,733
Errors (Since boot or last clear) :
FCS Rx : 0 Drops Tx : 0
Alignment Rx : 0 Collisions Tx : 0
Runts Rx : 0 Late Colln Tx : 0
Giants Rx : 0 Excessive Colln : 0
Total Rx Errors : 0 Deferred Tx : 0
Others (Since boot or last clear) :
Discard Rx : 0 Out Queue Len : 0
Unknown Protos : 0
Rates (5 minute weighted average) :
Total Rx (bps) : 503,952 Total Tx (bps) : 503,896
Unicast Rx (Pkts/sec) : 1 Unicast Tx (Pkts/sec) : 1
B/Mcast Rx (Pkts/sec) : 1 B/Mcast Tx (Pkts/sec) : 0
Utilization Rx : 00.50 % Utilization Tx : 00.50 %
If we only want to view the Broadcast information for port A1, we can use the "| i Bcast" after the command to only view Broadcast information:
*Note - Entries are Case-Sensitive when using the Include/Exclude options. We must enter them with the same syntax and capitalization as the original output shows.
Example: We must use "Bcast" and not "bcast" for the output to show correctly.
5400-1_5406zl# show int a1 | i Bcast
Bcast/Mcast Rx : 24,635,357 Bcast/Mcast Tx : 180,733
If we want to view both Broadcast and Unicast information, we can add "i Bcast|Unicast" to add multiple search entries.
5400-1_5406zl# show int a1 | i Bcast|Unicast
Unicast Rx : 739,499 Unicast Tx : 852,628
Bcast/Mcast Rx : 24,635,446 Bcast/Mcast Tx : 180,734
Unicast Rx (Pkts/sec) : 4 Unicast Tx (Pkts/sec) : 4
Limiting this information may be useful, especially when we only want to see Broadcast information for hundreds of ports.
For example, if we type in "show interface all | i Bcast", this will only show the broadcast output for all ports.
We can add a search for "Port" and "Bcast" to show the port number followed by the broadcast output for each port.
5400-1_5406zl# show int all | i Port|Bcast
Status and Counters - Port Counters for port A1
Bcast/Mcast Rx : 24,648,332 Bcast/Mcast Tx : 180,840
Status and Counters - Port Counters for port A2
Bcast/Mcast Rx : 19,332,174 Bcast/Mcast Tx : 102,774
Status and Counters - Port Counters for port A3
Bcast/Mcast Rx : 0 Bcast/Mcast Tx : 0
...
This can also be handy when trying to find specific entries in the event logs.
For example, If we want to check only for events related to the Power Supply, we could use the following command:
show log -a | i Power Supply
5400-1_5406zl# show log -a | i Power Supply
W 03/20/19 11:00:43 00576 chassis: 50V Power Supply 2 is Faulted. Failures: 1
W 04/23/19 11:41:02 00576 chassis: 50V Power Supply 2 is Faulted. Failures: 2
W 04/23/19 11:52:09 00576 chassis: 50V Power Supply 2 is Faulted. Failures: 3
Another way this can be useful when looking at the event logs, is to exclude certain data from the output.
For example, if the log is flooded with the same event message and we want to eliminate those entries from the output, we can use the "| e" command to exclude these entries.
In this example the log is filled with "High collision or drop rate" events:
W 04/24/19 21:21:37 00331 FFI: port C15-High collision or drop rate. See help.
W 04/25/19 03:24:05 00331 FFI: port C4-High collision or drop rate. See help.
W 04/25/19 03:35:04 00331 FFI: port C4-High collision or drop rate. See help.
W 04/25/19 03:43:50 00331 FFI: port B8-High collision or drop rate. See help.
W 04/25/19 04:59:28 00331 FFI: port A3-High collision or drop rate. See help.
I 04/25/19 05:33:33 03362 auth: User 'Admin' logged in from 192.168.1.12 to TELNET session
W 04/25/19 09:30:02 00331 FFI: port B16-High collision or drop rate. See help.
W 04/25/19 09:41:01 00331 FFI: port B16-High collision or drop rate. See help.
W 04/25/19 09:56:09 00331 FFI: port A3-High collision or drop rate. See help.
W 04/25/19 10:30:29 00331 FFI: port B16-High collision or drop rate. See help.
We can use the "show log -a | e High collision" command to filter out the High collision entries from the output:
5400-1_5406zl# show log -a | e High collision
I 04/25/19 05:33:33 03362 auth: User 'Admin' logged in from 192.168.1.12 to TELNET session
If we want to include or exclude multiple entries using the pipe option, we cannot use words within quotation marks.
For example, if we want to search the log for SSH and Telnet login entries, we can use the following command:
show log -a | i SSH|Telnet
(this will return log entries that contain SSH and Telnet)
When using the Pipe option, we cannot use quotes, or the search will not return any results for that output:
show log -a | i "SSH"|"Telnet"
(this will not return any results)
Another way to view specific event log entries is to search for a specific string of text using quotation marks after the "show log..." command.
This option does not use the Pipe option or the Include/Exclude options, and can only be used to search for one specific string of text.
For example if we want to search the event log for all events that occurred on "Slot C", we can use the following command:
show log -a "Slot C"
*Note - The text string within the quotation marks is also case sensitive and must match exactly as shown in the original output.
5400-1_5406zl# show log -a "Slot C"
Keys: W=Warning I=Information
M=Major D=Debug E=Error
---- Event Log listing: All Events Recorded ----
I 03/20/19 11:00:43 00068 chassis: Slot C Inserted
W 03/20/19 11:00:52 00274 chassis: Slot C self test failure or unsupported module