<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Firewall log: exact IP match]]></title><description><![CDATA[<p dir="auto">Good evening community.<br />
Since I've tried several ways with no positive result, I'm here to ask for a question.</p>
<p dir="auto">On the "Advanced log filter" section:</p>
<p dir="auto"><img src="/assets/uploads/files/1736351188383-b6f8468c-e1bb-4efb-89ce-afdbd04585c6-image.png" alt="b6f8468c-e1bb-4efb-89ce-afdbd04585c6-image.png" class=" img-fluid img-markdown" /></p>
<p dir="auto">I'd like to retrieve matches for a specific IP, for example 192.168.174.1.</p>
<p dir="auto">By putting 192.168.174.1 as Source IP Address:</p>
<p dir="auto"><img src="/assets/uploads/files/1736351271858-f5a58b88-ca99-4856-8c3b-f4ca3adfe9c3-image.png" alt="f5a58b88-ca99-4856-8c3b-f4ca3adfe9c3-image.png" class=" img-fluid img-markdown" /></p>
<p dir="auto">this is an example of the results:</p>
<p dir="auto"><img src="/assets/uploads/files/1736351615333-c336c125-8930-4cba-8484-f245f7775cbc-image.png" alt="c336c125-8930-4cba-8484-f245f7775cbc-image.png" class=" img-fluid img-markdown" /></p>
<p dir="auto">which means of course that the last octect, "1", is threated as "<strong>contains</strong>" instead of "<strong>equals</strong>" value.</p>
<p dir="auto">I'd like to understand how to obtain the results <strong>only related to</strong> 192.168.174.1, already tried:</p>
<p dir="auto">192.168.174.1 (KO, same behaviour)<br />
/\b192.168.174.1\b/ (KO, no logs to display)<br />
^192.168.174.1$ (KO, no logs to display)</p>
<p dir="auto">Any ideas?<br />
Thank you for your support,<br />
regards.<br />
Giuseppe</p>
]]></description><link>https://forum.netgate.com/topic/195904/firewall-log-exact-ip-match</link><generator>RSS for Node</generator><lastBuildDate>Tue, 10 Mar 2026 01:06:49 GMT</lastBuildDate><atom:link href="https://forum.netgate.com/topic/195904.rss" rel="self" type="application/rss+xml"/><pubDate>Wed, 08 Jan 2025 15:55:54 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[Reply to Firewall log: exact IP match on Mon, 13 Jan 2025 14:53:53 GMT]]></title><description><![CDATA[<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/jimp">@<bdi>jimp</bdi></a></p>
<p dir="auto">Hi Jimp, I didn't post previous screen for security reasons, entries were present ;)<br />
In any case, I tried your command for multiple grep matches and it works!<br />
Thank you a lot!<br />
Have a nice day.<br />
Giuseppe</p>
<p dir="auto"><img src="/assets/uploads/files/1736779852757-78ba2865-93fc-4e26-9605-e8e244f76a15-image.png" alt="78ba2865-93fc-4e26-9605-e8e244f76a15-image.png" class=" img-fluid img-markdown" /></p>
]]></description><link>https://forum.netgate.com/post/1202523</link><guid isPermaLink="true">https://forum.netgate.com/post/1202523</guid><dc:creator><![CDATA[heavymetalforever78]]></dc:creator><pubDate>Mon, 13 Jan 2025 14:53:53 GMT</pubDate></item><item><title><![CDATA[Reply to Firewall log: exact IP match on Mon, 13 Jan 2025 14:01:27 GMT]]></title><description><![CDATA[<p dir="auto">What you posted there would work but maybe just didn't have any matches at the time you were watching. It's all just text output there, string parsing, nothing that would stop multiple grep commands from working.</p>
<p dir="auto">To be more efficient, if you want to match lines with both strings, you should make one pattern that has both in the correct order:</p>
<pre><code class="language-shell">: tail -f /var/log/filter.log | filterparser.php | grep 'block.*x\.x\.x\.x'
</code></pre>
<p dir="auto">If you want to match multiple patterns (e.g. all blocks <em>or</em> all matches of that IP address) then you would use <code>egrep</code> or <code>grep -e</code> along with a pattern like <code>'(block|x\.x\.x\.x|y\.y\.y\.y)'</code> and it will match any of those patterns rather than requiring them all.</p>
]]></description><link>https://forum.netgate.com/post/1202507</link><guid isPermaLink="true">https://forum.netgate.com/post/1202507</guid><dc:creator><![CDATA[jimp]]></dc:creator><pubDate>Mon, 13 Jan 2025 14:01:27 GMT</pubDate></item><item><title><![CDATA[Reply to Firewall log: exact IP match on Mon, 13 Jan 2025 09:19:48 GMT]]></title><description><![CDATA[<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/jimp">@<bdi>jimp</bdi></a><br />
It works, thank you for your help!</p>
<p dir="auto">Just a little more question if possibile:</p>
<p dir="auto">To see logs in command line (realtime) I use:<br />
tail -f /var/log/filter.log | filterparser.php | grep -w [ip address]</p>
<p dir="auto">I noticed however that this command allows only 1 grep.</p>
<p dir="auto">Is there a way to increase to at least 2 grep?<br />
For example it should be useful to add:</p>
<p dir="auto">tail -f /var/log/filter.log | filterparser.php | grep -w [ip address] | grep block</p>
<p dir="auto">but as you may see there are no results.</p>
<p dir="auto"><img src="/assets/uploads/files/1736759918379-2276fff5-5d2c-4eb1-a031-6ba5b4421212-image.png" alt="2276fff5-5d2c-4eb1-a031-6ba5b4421212-image.png" class=" img-fluid img-markdown" /></p>
<p dir="auto">Thanks,<br />
Giuseppe</p>
]]></description><link>https://forum.netgate.com/post/1202480</link><guid isPermaLink="true">https://forum.netgate.com/post/1202480</guid><dc:creator><![CDATA[heavymetalforever78]]></dc:creator><pubDate>Mon, 13 Jan 2025 09:19:48 GMT</pubDate></item><item><title><![CDATA[Reply to Firewall log: exact IP match on Wed, 08 Jan 2025 18:24:37 GMT]]></title><description><![CDATA[<p dir="auto">They are regex fields, so <code>192\.168\.174\.1$</code> should exactly match the <code>.1</code> address and only the <code>.1</code> address. It works for me here, with or without the starting anchor (<code>^</code>). In this case you shouldn't need the start anchor but for an address with 1-2 numbers in the first octet, it could be necessary.</p>
<p dir="auto">If that doesn't find anything then there may not be any matching logs for that one address at the time you searched.</p>
]]></description><link>https://forum.netgate.com/post/1202044</link><guid isPermaLink="true">https://forum.netgate.com/post/1202044</guid><dc:creator><![CDATA[jimp]]></dc:creator><pubDate>Wed, 08 Jan 2025 18:24:37 GMT</pubDate></item></channel></rss>