RAGREP(1)

💖 RAGREP(1) — bestie edition 💖

okay so this is a page from the General Commands Manual, and it's all about ragrep. pull up a chair, grab a strawberry 🍓, we're doing this.

---

✨ NAME ✨

ragrep — grep argus(8) user captured data. that's it, that's the whole vibe. it's grep but for argus records, no cap. 🦋

---

🌸 SYNOPSIS 🌸

ragrep [options] -e pattern [raoptions] [-- filter-expression]
ragrep [options] -f file    [raoptions] [- filter-expression]

two ways in, pick your fighter. 💅

---

🎀 DESCRIPTION 🎀

okay so ragrep reads argus data from an argus-data source, greps the records based on the regexp you handed it on the command line, and spits out a valid argus-stream. it's giving filter queen. 👑

important tho: ragrep works only on the fields for user captured data. so argus has to be started with the configration option ARGUS_CAPTURE_DATA_LEN set to a value greater than 0 to have these data captured, otherwise there's literally nothing there to grep. see argus.conf(5) for detail. don't skip this bestie, it's the whole ballgame. 🫶

also ragrep is based on GNU grep(1), so the regexp syntax is the same as for grep(1). so if you know grep, you already know this. iykyk. 🌈

---

💅 OPTIONS 💅

ragrep, like all ra based clients, supports a number of ra options including filtering of input argus records through a terminating filter expression. see ra(1) for a complete description of ra options. the ragrep(1) specific options are:

• -c — suppress normal output; instead print a count of matching lines for each input file. and with the -v, --invert-match option (see below), it counts the non-matching lines. count girlie behavior, obsessed. 🔥
• -e <regex> — match regular expression in flow user data fields. prepend the regex with either "s:" or "d:" to limit the match to either the source or destination user data fields. examples include:

"^SSH-"           - Look for ssh connections on any port.
"s:^GET"          - Look for HTTP GET requests in the source buffer.
"d:^HTTP.*Unauth" - Find unauthorized http response.

like, the s: and d: prefixes are the little main character moments here. ⭐

• -f FILE — obtain patterns from FILE, one per line. the empty file contains zero patterns, and therefore matches nothing. so an empty file is literally the "no thoughts head empty" of pattern files. 💀
• -i — ignore case distinctions in both the PATTERN and the input files. case is not the moment, we're being chill about it. 🙈
• -L — suppress normal output; instead print the name of each input file from which no output would normally have been printed. the scanning will stop on the first match. it's the anti--l, the villain arc. 🖤
• -l — suppress normal output; instead print the name of each input file from which output would normally have been printed. the scanning will stop on the first match. just names, no content, mysterious. ✨
• -q — quiet; do not write anything to standard output. exit immediately with zero status if any match is found, even if an error was detected. silent but deadly, we love a mysterious icon. 🎀
• -R — read all files under each directory, recursively; this is equivalent to the -d recurse option. go deep, bestie, go all the way down. 🌀
• -v — reverse the expression matching logic. plot twist era. 🔄

---

👑 DIAGNOSTICS 👑

normally, exit status is 0 if selected records are found and 1 otherwise. but the exit status is 2 if an error occurred — unless the -q option is used and a selected line is found. so like, 2 is the "something went wrong" number, and -q gets to override that if it found a match. chaotic but iconic. 💜

---

🧚 INVOCATION 🧚

here's a sample invocation of ragrep(1). this call reads argus(8) data from inputfile and greps all http transactions that generated a "404 Not Found" error.

ragrep -r inputfile -e "HTTP.*404"

look at her go. slay. 🔥

---

💖 SEE ALSO 💖

ra(1), rarc(5), argus(8), — go read those too, they're the extended universe. 📚

---

🌸 COPYRIGHT 🌸

Copyright (c) 2000-2024 QoSient. All rights reserved.

---

🎀 AUTHORS 🎀

Carter Bullard (carter@qosient.com). the icon, the legend. 👑

---

💀 BUGS 💀

the bugs section is... empty. not a single bug listed. we're choosing to believe that's a flex. 🫶

---

okay that's the whole page!! and just so you have the receipts, this is ragrep 5.0.3, dated 15 March 2023, and the manual page name is RAGREP(1). love that for us. bye bestie, go grep something 💅✨