CLI grep command in AsyncOS 4.5

Question

A late addition to AsyncOS 4.5 was the CLI "grep" command. Yes, it is a "hidden" command and we would like input from IronPort Nation on whether this is useful and what additions they would like to see to it. Here are a brief set of examples on its use:
boxster.mfg> help grep
grep -e regexp [-e regexp] [-i] [-p] [-t] log_name
Run the Unix grep command over the named log file.
Normally the grep will be run over all files in the
named log subscription. Using the -t option will run
the grep over a tail of the log file. Using the -i
option will ignore case sensitivities. Using the -p
option will paginate the output.
regexp - an extended grep expression
log_name - the name of the log file
Manually using grep will look like this:
boxster.mfg> grep
Currently configured logs:
1. "antivirus" Type: "Anti-Virus Logs" Retrieval: FTP Poll
2. "asarchive" Type: "Anti-Spam Archive" Retrieval: FTP Poll
3. "avarchive" Type: "Anti-Virus Archive" Retrieval: FTP Poll
4. "bounces" Type: "Bounce Logs" Retrieval: FTP Poll
5. "brightmail" Type: "Symantec Brightmail Anti-Spam Logs" Retrieval: FTP Poll
6. "case" Type: "Context Adaptive Scanning Engine" Retrieval: FTP Poll
7. "cli_logs" Type: "CLI Audit Logs" Retrieval: FTP Poll
8. "error_logs" Type: "IronPort Text Mail Logs" Retrieval: FTP Poll
9. "ftpd_logs" Type: "FTP Server Logs" Retrieval: FTP Poll
10. "gui_logs" Type: "HTTP Logs" Retrieval: FTP Poll
11. "mail_logs" Type: "IronPort Text Mail Logs" Retrieval: FTP Poll
12. "scanning" Type: "Scanning Logs" Retrieval: FTP Poll
13. "sntpd_logs" Type: "NTP logs" Retrieval: FTP Poll
14. "status" Type: "Status Logs" Retrieval: FTP Poll
15. "system_logs" Type: "System Logs" Retrieval: FTP Poll
Enter the number of the log you wish to grep.
[]> 11
Enter the regular expression to grep.
[]> MID
Do you want this search to be case insensitive? [Y]> n
Do you want to tail the logs? [N]>
Do you want to paginate the output? [N]>
For a single regular expression:
boxster.mfg> grep -e MID mail_logs
For multiple regular expressions:
boxster.mfg> grep -e MID -e RID mail_logs
For multiple regular expressions in the current log:
boxster.mfg> grep -e MID -e RID mail_logs -t
For multiple regular expressions in the current log with a case
insensitive match and paginate:
boxster.mfg> grep -i -e MID -e RID mail_logs -t -p
Grab a specific ICID line:
boxster.mfg> grep -e "ICID1238" mail_logs
Tue Oct 18 07:58:19 2005 Info: New SMTP ICID 1238 interface main (172.18.0.40) address 172.18.0.40 reverse dns host porky3.mfg verified yes
Tue Oct 18 07:58:19 2005 Info: ICID 1238 ACCEPT SG None match ALL SBRS rfc1918
Tue Oct 18 07:58:19 2005 Info: Start MID 211476 ICID 1238
Tue Oct 18 07:58:19 2005 Info: MID 211476 ICID 1238 From: <[email protected]>
Tue Oct 18 07:58:19 2005 Info: MID 211476 ICID 1238 RID 0 To: <[email protected]>
Tue Oct 18 07:58:19 2005 Info: ICID 1238 close
Look for DHAP connections:
boxster.mfg> grep -t -e "Dropping connection" mail_logs
Press Ctrl-C to stop.
Wed Oct 19 18:05:28 2005 Warning: LDAP: Dropping connection due to potential Directory Harvest Attack from host=('172.18.0.40', None), dhap_limit=5, sender_group=Default
Wed Oct 19 18:05:30 2005 Warning: LDAP: Dropping connection due to potential Directory Harvest Attack from host=('172.18.0.40', None), dhap_limit=5, sender_group=Default
Wed Oct 19 18:05:32 2005 Warning: LDAP: Dropping connection due to potential Directory Harvest Attack from host=('172.18.0.40', None), dhap_limit=5, sender_group=Default
Wed Oct 19 18:06:15 2005 Warning: LDAP: Dropping connection due to potential Directory Harvest Attack from host=('172.18.0.40', None), dhap_limit=5, sender_group=Default
Wed Oct 19 18:06:17 2005 Warning: LDAP: Dropping connection due to potential Directory Harvest Attack from host=('172.18.0.40', None), dhap_limit=5, sender_group=Default

Answer 1

(Been away from IPN for a while, catching up).
As a long time Unix sysadmin, I'm also a little frustrated by the locked down nature of AsyncOS, especially since I know that under the hood it's my particular Unix flavor of choice. For example, when I see the CPU stuck at or near 100%, I really want to fire up "top" and see what's soaking up the CPU. I had that problem recently and needed to make a tech support call for what turned out to be something I could have diagnosed myself had I just been able to use "top". I've also had times when direct access to "netstat" and "ifconfig -a" would have saved me a lot of trouble (like when someone changed the duplex setting on the switch port).
That said, I know that IronPort has some valuable intellectual property to protect from prying eyes. But it seems to me that a compromise could be reached. We don't need to be able to peek under every rock in order to have much improved sysadmin abilities.
Oh yeah, I like the "grep" command. :-) I've been wishing for that for quite a while.