Drill 06: Alternation

# Match authentication outcomes
grep -E '(Passed|Failed)-(Authentication|Attempt)' /var/log/ise-psc.log

# Match ISE event types
grep -Ei '(authentication|authorization|accounting|profiling)' /var/log/ise-psc.log

# Match error codes
grep -E 'Error (11|12|13|24|27)' /var/log/ise-psc.log

# Match interface status messages
grep -E '(up|down|changed state to)' /var/log/switch.log

# Match Cisco severity levels
grep -E '%[A-Z]+-([0-3])-' /var/log/cisco.log  # Critical (0-3)

# Match spanning tree events
grep -Ei '(STP|RSTP|MSTP|BPDU)' /var/log/switch.log

# Match systemd unit states
systemctl list-units | grep -E '(failed|inactive|activating)'

# Match running services
systemctl --type=service | grep -E '(running|exited)'

# Match critical services
systemctl status | grep -E '(sshd|nginx|docker|kubelet)'

# Find TODO markers
grep -ri '(TODO|FIXME|HACK|XXX):' ~/notes/

# Find priority tags
grep -Ei '#(urgent|important|priority|deadline)' ~/notes/*.md

# Find date formats
grep -E '(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{1,2}' ~/journal/

# Match expense categories
grep -Ei '(groceries|utilities|rent|insurance|entertainment)' ~/budget/*.csv

# Match transaction types
grep -Ei '(debit|credit|transfer|payment|deposit)' ~/bank/*.txt

# Match currencies
grep -E '\$(USD|EUR|GBP|CAD|AUD)' ~/receipts/

# Match days of week
grep -Ei '(monday|tuesday|wednesday|thursday|friday|saturday|sunday)' ~/calendar.txt

# Match time periods
grep -Ei '(morning|afternoon|evening|night)' ~/schedule.txt

# Match meeting types
grep -Ei '(meeting|call|standup|review|demo)' ~/calendar/*.ics

# Basic alternation
grep -E 'cat|dog' file.txt

# With word boundaries
grep -wE 'cat|dog' file.txt

# Count matches per alternative (use multiple greps)
echo "Cats: $(grep -c 'cat' file.txt), Dogs: $(grep -c 'dog' file.txt)"

# Case-insensitive
grep -Ei 'error|warning|critical' logs.txt

# Replace multiple patterns with same replacement
sed -E 's/(ERROR|FATAL|CRITICAL)/[ALERT]/g' file.txt

# Add prefix to alternatives
sed -E 's/(Mon|Tues|Wednes|Thurs|Fri)day/Weekday: &/g' file.txt

# Remove any of several patterns
sed -E 's/(DEBUG|TRACE):.*//' file.txt

# Convert alternatives
sed -E 's/(http|https)/SECURE/g' urls.txt

# Match lines with alternatives
awk '/(ERROR|WARN|FATAL)/' file.txt

# Count alternatives separately
awk '/ERROR/{e++} /WARN/{w++} /FATAL/{f++} END{print "E:",e,"W:",w,"F:",f}' file.txt

# Process based on match
awk '/(ERROR|FATAL)/{print "CRITICAL:", $0} /(WARN|INFO)/{print "NORMAL:", $0}' file.txt

# Field-specific matching
awk '$1 ~ /(permit|deny)/ {print}' acl.txt

" Find ERROR or FATAL
/\v(ERROR|FATAL)

" Replace log levels
:%s/\v(DEBUG|TRACE)/VERBOSE/g

" Find function or class definitions
/\v(function|class|def)\s+\w+

" Find common typos
:%s/\v(teh|hte)/the/g

" Highlight alternatives (very magic mode)
/\v(Monday|Tuesday|Wednesday|Thursday|Friday)

import re

text = """ERROR: Connection failed
WARNING: Low memory
INFO: Process started
FATAL: System crash"""

# Basic alternation
pattern = re.compile(r'(ERROR|FATAL)')
matches = pattern.findall(text)
print(matches)  # ['ERROR', 'FATAL']

# Named groups with alternation
pattern = re.compile(r'(?P<level>ERROR|WARNING|INFO|FATAL): (?P<msg>.+)')
for match in pattern.finditer(text):
    print(f"{match.group('level')}: {match.group('msg')}")

# Case-insensitive alternation
pattern = re.compile(r'error|warning|fatal', re.IGNORECASE)

# Alternation with grouping
days = re.compile(r'(Mon|Tues|Wednes|Thurs|Fri|Satur|Sun)day')

# WRONG: Matches "gray" or "grey" NOT "gr" + "a|e" + "y"
echo "gray grey" | grep -oE 'gray|grey'

# Understanding precedence:
# 'ab|cd' means 'ab' OR 'cd', NOT 'a' + 'b|c' + 'd'

# Use grouping for partial alternation:
echo "gray grey" | grep -oE 'gr(a|e)y'
# Output: gray, grey

# Optional prefix
grep -E '(un)?happy' file.txt      # "happy" or "unhappy"

# Optional suffix
grep -E 'run(ning|s)?' file.txt    # "run", "running", or "runs"

# Multiple alternatives in sequence
grep -E '(Mon|Tues|Wednes)day (morning|afternoon)' file.txt

# Nested grouping
grep -E '((http|https)://)?www\.' file.txt

# WRONG: "light" never matches (matched by "li")
echo "light flight" | grep -oE 'li|light'
# Output: li, li

# CORRECT: Longer/specific patterns first
echo "light flight" | grep -oE 'light|li'
# Output: light

# For file extensions:
# WRONG: .doc matches first in .docx
grep -E '\.(doc|docx)' files.txt

# CORRECT: More specific first
grep -E '\.(docx|doc)' files.txt

# If INFO is most common in logs:
grep -E '(INFO|WARN|ERROR)' huge.log  # INFO checked first

# vs
grep -E '(ERROR|WARN|INFO)' huge.log  # ERROR checked first (rarely matches)

# WRONG: Matches "grey" or "gray" but captures everything
echo "The grey cat" | grep -oE 'grey|gray'
# Intended: Just the color

# CORRECT with word boundary
echo "The grey cat" | grep -oE '\b(grey|gray)\b'

# INEFFICIENT: Alternation for single chars
grep -E 'a|e|i|o|u' file.txt

# EFFICIENT: Character class
grep -E '[aeiou]' file.txt

# Character class is MUCH faster for large files

# Shell quoting required
grep -E 'cat|dog' file.txt       # Works (single quotes)
grep -E "cat|dog" file.txt       # Works (double quotes, no $ in pattern)
grep -E cat\|dog file.txt        # Works (escaped)
grep -E cat|dog file.txt         # FAILS (pipe goes to shell)

# BRE requires escaping the pipe
grep 'cat\|dog' file.txt         # BRE (no -E)
grep -E 'cat|dog' file.txt       # ERE (with -E)

# WRONG: Empty alternative matches everything
echo "test" | grep -E '|test'
# Matches: "" (empty), "test" - every position matches!

# CORRECT: Make it explicit
echo "test" | grep -E 'test|$'  # Match "test" or end of line