Description
This article describes how to use the 'grep' command in the CLI of a FortiGate system.
Scope
FortiGate v4.0 MR2, v4.0 MR3, v5.0.x, v6.0.x, v6.2.x v6.4.x, v7.0.x, v7.2.x, v7.4.x, and v7.6.x.
FortiMail.
Solution
The 'grep' command is applied as a standard command filter within the FortiOS firmware, with the following syntax:
show <subcommand> | grep <expression>
diagnose <subcommand> | grep <expression>
Example:
show system interface
config system interface
edit "port1"
set vdom "root"
set ip 192.168.183.104 255.255.254.0
set allowaccess ping ssh http telnet
set type physical
next
edit "port2"
set vdom "root"
set ip 172.31.225.104 255.255.254.0
set allowaccess ping https ssh http telnet
set type physical
next
show sys interface | grep 192
set ip 192.168.183.104 255.255.254.0
show system interface | grep https
set allowaccess ping https ssh http telnet
On the other hand, the option -invfcABC can be used to further filter out the output.
grep: option requires an argument -- 'A'
Usage: grep [-invfcABC] PATTERN
Options:
-i Ignore case distinctions
-n Print line number with output lines
-v Select non-matching lines
-f Print fortinet config context
-c Only print count of matching lines
-A Print NUM lines of trailing context
-B Print NUM lines of leading context
-C Print NUM lines of output context
On new firmware versions as v7. x, new grep options were added. Here is the output collected from a FortiGate running v7.0.12:
Usage: grep [-ilHhnqvscABC] PATTERN [FILE...]
Options:
-i Ignore case distinctions
-l List names of files that match
-H Prefix output lines with filename where match was found
-h Suppress the prefixing filename on output
-n Print line number with output lines
-q Quiet
-v Select non-matching lines
-s Suppress file open/read error messages
-c Only print count of matching lines
-A Print NUM lines of trailing context
-B Print NUM lines of leading context
-C Print NUM lines of output context
To use the 'grep' command for multiple expressions, each expression should be separated by '\|' and everything should be within the single quotes as below:
show | grep -f '<expression_1>\|<expression_2>\|<expression_3>\|...'
Example 1:
show | grep -f 'internal\|wan'
show | grep -f 'internal\|wan\|port1'
show | grep -f 'internal\|wan\|port1\|port2'
show | grep -f 'internal\|wan\|port1\|port2\|port3'
show | grep -f 'internal\|wan\|port1\|port2\|port3\|port4'
Example 2: Checking dropped and error counters only under interface port1 stats:
FGT01 # diagnose hardware deviceinfo nic port1 | grep 'Name\|dropped\|errors'
Name: port1
Rx dropped: 0
Rx errors: 0
Tx dropped: 0
Tx errors: 0
