On Wed, 14 Aug 2024 at 11:48, Pádraig Brady <p...@draigbrady.com> wrote: > > tag 72617 notabug > close 72617 > stop > > On 14/08/2024 09:43, Simon B wrote: > > Hallo, > > > > The output of my grep command is: > > > > # grep -i "sshd" /root/access.report | egrep -o > > > > '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0- > > 9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' > > 64.227.127.122 > > 172.169.5.249 > > 172.169.6.164 > > Adding the --debug option shows the issue. > I.e. the '.' being considered as part of a number: > > $ sort --debug -rbn -s ips > sort: text ordering performed using ‘en_IE.UTF-8’ sorting rules > sort: note numbers use ‘.’ as a decimal point in this locale > 178.128.44.128 > _______ > 172.169.6.164 > _______ > 172.169.5.249 > _______ > > > Taking the example for sorting IPv4 addresses from the manual, > shows the desired comparisons being performed: > > $ sort --debug -t '.' -k 1,1rn -k 2,2rn -k 3,3rn -k 4,4rn -u ips > sort: text ordering performed using ‘en_IE.UTF-8’ sorting rules > sort: numbers use ‘.’ as a decimal point in this locale > 178.128.44.128 > ___ > ___ > __ > ___ > 172.169.6.164 > ___ > ___ > _ > ___ > 172.169.5.249 > ___ > ___ > _ > ___ >
Hi Pádraig I am largely satisfied by your great explanation, I am still confused why lines go "missing" though. Unsorted output # grep -i "sshd" /root/access.report | egrep -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' | wc -l 41 Sorted once: # grep -i "sshd" /root/access.report | egrep -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' | sort -urbn | wc -l 15 Sorted workaround: # grep -i "sshd" /root/access.report | egrep -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' | sort -urb | sort -nr | wc -l 17 Even if the dot is being interpreted, it still should not lose the line containing 172.169.6.164 Regards Simon
