OK, yet another reply to myself to correct an error, even though it is moot now. On Wed, 23 Oct 2024 23:35:32 +0000 (UTC), Robert Webb <webbdg@verizon.net> wrote: [To filter journal lines like this one:]
Oct 19 10:15:52 silversurfer clamd[2059]: File path check failure on: /home/ mercurio/.local/share/local-mail/solucion freenet/cur/ 1619518303440.R45.silversurfer:2,S
[Set these]
PID_re='[0-9]\+'
PATH_re='/home/.*'
SPAM_re=' silversurfer clamd\['"$PID_re"'\]: File path check failure \(on\|for\): '"$PATH_re"'$'
Because the pipe symbol (vertical bar character) is used in the regex ($SPAM_re), and because it can also be a regular character if not escaped, it cannot be used as the regex delimiter. So, using commas instead: journalctl -t clamd |sed -n -e "1,\\,$SPAM_re,p" If there are initial non-"spam" lines, they will be output followed by just the first "spam" line. Otherwise, the first two spam lines will be shown. Here is sample journalctl output posted by Stakanov. Attached: data-journal.txt P.S. Have I learned my lesson yet? Proper answer, avoiding details: "Use grep or something to filter the output." -- Robert Webb