rg — Log Searching

rg’s SIMD-accelerated search makes it ideal for filtering large log streams. Use it on the output of journalctl, directly on log files, or across rotated/compressed archives. The key patterns: pipe for live streams, file arguments for on-disk logs, and find + zgrep for compressed rotations.

--no-pager prevents journalctl from invoking less — required for piping. -C 2 adds 2 lines of context above and below each match. rg reads stdin when no file argument is given. This is the bread-and-butter log search.

-c on a stdin stream gives a single count (no filename prefix). -p err pre-filters to error priority at the journald level, then rg further refines. The || echo "0 matches" handles the case where rg exits 1 (no matches) — which would otherwise look like a failure.

_COMM=sshd filters to the sshd unit at the journal level — far more efficient than grepping the entire journal. rg then refines to authentication failures. On systems with /var/log/auth.log, use rg -i 'failed password|invalid user' /var/log/auth.log instead.

-o prints only the matched text. -i catches case variations. sort | uniq -c | sort -rn is the standard frequency analysis pipeline. The result is a ranked list of unique error messages by occurrence count.

Always constrain the time window at the journalctl level first — it uses binary search on the journal, which is orders of magnitude faster than piping the entire journal through rg. The rg pattern further refines within that window.

Each -e adds an alternative pattern (logical OR). Cleaner than 'error|warn|fail' when any pattern contains regex metacharacters. --color=never strips ANSI codes — essential when piping output to further processing.

rg cannot read compressed files natively. For .gz rotated logs, find + zgrep is the correct tool. First command lists available archives; second searches them. For uncompressed rotated logs (e.g., syslog.1), rg works directly: rg 'pattern' /var/log/syslog.*.

Captures IP, method, path, and status code from combined log format. -Po for PCRE2 + only-match. -r reshapes the output. Pipe to sort | uniq -c | sort -rn for frequency analysis by IP, path, or status code.

rg’s multi-file output includes the filename prefix, making it easy to see which log source each hit comes from. Use this to correlate a suspicious IP across authentication logs, firewall logs, and application logs in a single command.

Extracts the timestamp truncated to the minute, then counts per minute. A spike in the count column indicates a brute-force attempt or service failure burst. Adjust the regex to truncate to hour (\d{2}) or second (\d{2}:\d{2}:\d{2}) as needed.