On Thu, 5 Jun 2025, Richard Lewis wrote:
> practice grep seems not always give the warning, even though every reported
> line is matched against every regexp (?)
Dear Richard,
It seems grep regards differently the command line pattern and the
-f patternfile.
Command
for f in * ; do echo $f================; grep -E -f $f /dev/null 2>&1 ; done
reports only two problems:
...
login================
grep: login:8: Unmatched ( or \(
...
systemd================
grep: systemd:21: Unmatched ( or \(
...
But both comes from comments:
# old messages, no longer seen (?)
# services with Restart=always ((eg console-getty.service)
IMHO the most cases the problem is that literal square brackets
are unescaped. E.g.
| courier================
| grep: Unmatched [, [^, [:, [., or [=
| ^(w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+
((imap|pop3)(login|d-ssl)|couriertcpd): (LOGOUT|TIMEOUT|DISCONNECTED),
ip=[[.:[:alnum:]]+](, port=[[[:digit:]]+])?, headers=[[:digit:]]+,
body=[[:digit:]]+$
ip=[[.:[:alnum:]]+] and port=[[[:digit:]]+] are suspicious.
I guess they should be ip=\[[.:[:alnum:]+]\] and \[[[:digit:]+]\] .
| cron-apt================
| grep: Invalid range end
| ^(w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ cron-apt: CRON-APT
RUN [[-[:alnum:]/]+]: w{3} w{3} [ [:digit:]]+ [:[:digit:]]{8} w{3,4}
[[:digit:]]{4}$
[[-[:alnum:]/]+] should be \[[-[:alnum:]/]+\] .
| dovecot================
| grep: Unmatched [, [^, [:, [., or [=
| ^(w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ (dovecot:
)?(imap|pop3)-login: Disconnected [[.:[:xdigit:]]+]$
I bet on \[[.:[:xdigit:]]+\] .
| exim4================
| grep: Unmatched [, [^, [:, [., or [=
| ^[-0-9]{10} [0-9:]{8} [-[:alnum:]]+ [=-]> [@._[:alnum:]-]+
<?[@._[:alnum:]-]+>? R=dnslookup T=remote_smtp H=[._[:alnum:]-]+ [[.0-9]{7,15}]$
[[.0-9]{7,15}] is probably \[[.0-9]{7,15}\] .
| horde3================
| grep: Unmatched [, [^, [:, [., or [=
| ^(w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ .+[[0-9]+]: [horde] Login
success for [@._[:alnum:]-]+ [[.0-9]{7,15}] to Horde [on line [0-9]+ of ".+"]$
\[[.0-9]{7,15}] to Horde [on line [0-9]+ of ".+"\]
Cheers
Gabor
