Ubuntu – Keeping color from vim with grep

The terminal output will be colored if the content of the file will be sent "as-is" to the terminal, without any modifications. However, vim and some other editors will escape meta characters in the text and instead maybe add some other color codes for their syntax highlighting, so this doesn't work.

Try dumping the file to the terminal with cat, this should work. Some simple editors or pagers like less might also work.

Edit: I have not found a way to let vim "pass-through" all the escape codes, but I have found this answer which links to this vim script, which parses the escape codes and uses the vim syntax highlighting to recreate the color codes in the output. According to its description, it should do exactly what you want (but I have not tested it).

Yet another solution:

awk '{ 
      for (i = 1; i <= NF; i++) 
        if ($i ~ /^SRC=/) 
          print substr($i, 5) 
    }' /var/log/syslog |
  sort -u |
  while read ip; do
    printf ' === %s ===\n' "$ip"
    whois "$ip"
  done

If you only want to select lines of syslog containing the string INVALID STATE, then the above code can be modified as follows

awk '/INVALID STATE/ { 
      for (i = 1; i <= NF; i++) 
        if ($i ~ /^SRC=/) 
          print substr($i, 5) 
    }' /var/log/syslog |
  sort -u |
  while read ip; do
    printf ' === %s ===\n' "$ip"
    whois "$ip"
  done