neulab/tldr huggingface dataset:
Without arguments, all collected logs are shown unfiltered:
With one match specified, all entries with a field matching the expression are shown:
journalctl _SYSTEMD_UNIT=avahi-daemon.service journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope
If two different fields are matched, only entries matching both expressions at the same time are shown:
journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097
If two matches refer to the same field, all entries matching either expression are shown:
journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service
If the separator "+" is used, two expressions may be combined in a logical OR. The following will show all messages from the Avahi service process with the PID 28097 plus all messages from the D-Bus service (from any of its processes):
journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
To show all fields emitted by a unit and about the unit, option -u/--unit= should be used.  journalctl -u name expands to a complex filter similar to
_SYSTEMD_UNIT=name.service + UNIT=name.service _PID=1 + OBJECT_SYSTEMD_UNIT=name.service _UID=0 + COREDUMP_UNIT=name.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
(see systemd.journal-fields(7) for an explanation of those patterns).
Show all logs generated by the D-Bus executable:
journalctl /usr/bin/dbus-daemon
Show all kernel logs from previous boot:
journalctl -k -b -1
Show a live log display from a system service apache.service:
journalctl -f -u apache
systemd(1), systemd-journald.service(8), systemctl(1), coredumpctl(1), systemd.journal-fields(7), journald.conf(5), systemd.time(7), systemd- journal-remote.service(8), systemd-journal-upload.service(8)
1. Journal Export Format https://www.freedesktop.org/wiki/Software/systemd/export
2. Journal JSON Format https://www.freedesktop.org/wiki/Software/systemd/json
3. Server-Sent Events https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events
4. JavaScript Object Notation (JSON) Text Sequences https://tools.ietf.org/html/rfc7464
5. Message Catalog Developer Documentation https://www.freedesktop.org/wiki/Software/systemd/catalog
6. Discoverable Partitions Specification https://systemd.io/DISCOVERABLE_PARTITIONS
tcpflow(1)                        tcpflow 1.6.1                       tcpflow(1)
tcpflow - TCP flow recorder
tcpflow [-aBcCDIpsZ] [-b max_bytes] [-d debug_level] [-[eE] scanner] [-f max_fds] [-F[ctTXMkmg]] [-h|--help] [-i iface] [-l file1.pcap file2.pcap...]  [-L semlock] [-m min_bytes] [-o outdir] [-r file1.pcap] [-R file0.pcap] [-S name=value] [-T[filename template]] [-U|--relinquish-privileges username] [-v|--verbose] [-V|--version] [-w file] [-x scanner] [-X file.xml] [-z|--chroot directory] [expression]
tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging.  Rather than showing packet-by-packet information, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis.  tcpflow understands TCP sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery. tcpflow provides control over filenames for automatic binning of connections by protocol, IP address or connection number, and has a sophisticated plug-in system for decompressing compressed HTTP connections, undoing MIME encoding, or calling user-provided programs for post-processing.
By default tcpflow stores all captured data in files that have names of the form:
192.168.101.102.02345-010.011.012.013.45103
...where the contents of the above file would be data transmitted from host 192.168.101.102 port 2345, to host 10.11.12.13 port 45103.
If you want to simply process a few hundred thousand packets and see what you have, try this:
tcpflow -a -o outdir -Fk -r packets.pcap
This will cause tcpflow to perform (-a) all processing, store the output in a directory called outdir, bin the output in directories of 1000 connections each, and read its input from the file packets.pcap. More sophisticated processing is possible, of course.
-a     Enable all processing. Same as -e all.
-B     Force binary output even when printing to console with -C or -c.
-b max_bytes Specifies the maximum size of a captured flow.  Any bytes beyond max_bytes from the first byte captured will be discarded.  The default is to store an unlimited number of bytes per flow. Note: before version 1.4, tcpflow could only store a maximum of 4GiB per flow.
-c     Console print.  Print the contents of packets to stdout as they are received, without storing any captured data to files (implies -s).
-C     Console print without the packet source and destination details being printed.  Print the contents of packets to stdout as they are received, without storing any captured data to files (implies -s).
-D     Console output should be in hex.
-d     Debug level.  Set the level of debugging messages printed to stderr to debug_level.  Higher numbers produce more messages.  -d 0 causes completely silent operation.  -d 1 , the default, produces minimal status messages.  -d 10 produces verbose output equivalent to -v .  Numbers higher than 10 can produce a large amount of debugging information useful only to developers.
-E name Disable all scanners and then enable scanner name
-e name Enable scanner name.
-e all Enables all scanners. Same as -a
-e http Perform HTTP post-processing ("After" processing). If the output file is
208.111.153.175.00080-192.168.001.064.37314,
Then the post-processing will create the files:
208.111.153.175.00080-192.168.001.064.37314-HTTP 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY
If the HTTPBODY was compressed with GZIP, you may get a third file as well:
208.111.153.175.00080-192.168.001.064.37314-HTTPBODY-GZIP
Additional information about these streams, such as their MD5 hash value, is also written to the DFXML report file.
-e python -S py_path=path -S py_module=module -S py_function=foo Post-process TCP payload by an external python function.
The python function must take a single string parameter.  The python function can return a string (else the function does must not return).  The returned string (if any) is written in the DFXML report file inside the XML tag <scan_python_result>...</scan_python_result>.  A sample python script is available within the tcpflow source code in directory python/plugins.
tcpflow -r my.cap -e python -S py_path=python/plugins -S py_module=samplePlugin -S py_function=sampleFunction
-F[format] Specifies format for output filenames.
Format specifiers:
c      Appends the connection counter to ALL filenames.
t      Prepends each filename with a Unix timestamp (seconds since epoch).
T      Prepends each filename with an ISO-8601 timestamp.
X      Do not output any files (other than the DFXML report file).
-FM    Include MD5 of each flow in the DFXML report file.
-FX    Suppresses file output entirely, DFXML report file is still produced.
-Fk    bin output in 1K directories
-Fm    bin output in 1M directories (2 levels)
-Fg    bin output in 1G directories (3 levels)
-fmax_fds Max file descriptors used.  Limit the number of file descriptors used by tcpflow to max_fds.  Higher numbers use more system resources, but usually perform better.  If the underlying operating system supports the setrlimit() system call, the OS will be asked to enforce the requested limit.  The default is for tcpflow to use the maximum number of file descriptors allowed by the OS.  The -v option will report how many file descriptors tcpflow is using.
-g     Output flow information to console in multiple colors. (Blue for client to server flows, red for server to client flows, green for undecided flows.)  Note: This option was different from tcpflow 1.3 (-e) and 1.4.4 (-J).
-h --help Help.  Print usage information and exit.
-hh    More help.  Print more usage information and exit.
-i iface Interface name.  Capture packets from the network interface named iface.  If no interface is specified with -i , a reasonable default will be used by libpcap automatically.
-I     Store the reception timestamps (of TCP packets) in a companion file *.findx.  Therefore each flow will have two files: (1) the usual file containing payload bytes and (2) the text file containing the corresponding timestamps.  This last file *.findx has three columns using the pipe '|' as separator:
byte-index|timestamp|length
The byte-index column is the postion within the file containing the payload bytes.  The timestamp column represents the number of seconds since epoch as a floating point number.  The precision is the microsecond but may also be the nanosecond in a future tcpflow version.  The length column is the number of successive bytes concerned by timestamp and can include several TCP frames (TCP packets).  The extension findx may become from the fact that the timestamps are frame indexed.
-L semlock_name Specifies that semlock_name should be used as a Unix semaphore to prevent two different copies of tcpflow running in two different processes but outputting to the same standard output from printing on top of each other. This is an application of Unix named semaphores; bet you have never seen one before.
-l     Treat the following arguments as filenames with an assumed -r command before each one.  This allows you to read a lot of files at once with shell globbing. For example, to process all of the pcap files in the current directory, use this:
tcpflow -o out -a -l *.pcap
-m min_size Forces a new connection output file when there is a skip in the TCP session of min_size bytes or more.
-o outdir Specifies the output directory where the transcript files will be written.
-P     No purge. Normally tcpflow removes connections from the hash table after the connection is closed with a FIN. This conserves memory but takes additional CPU time. Selecting this option causes the std::tr1:unordered_map to grow without bounds, as tcpflow did prior to version 1.1. That makes tcpflow run faster if there are less than 10 million connections, but can lead to out-of-memory errors.
-p     No promiscuous mode.  Normally, tcpflow attempts to put the network interface into promiscuous mode before capturing packets. The -p option tells tcpflow not to put the interface into promiscuous mode.  Note that it might already be in promiscuous mode for some other reason.
-q     Quiet mode --- don't print warnings. Currently the only warning that tcpflow prints is a warning when more than 10,000 files are created that the user should have provided the -Fk, -Fm, or -Fg options. We might have other warnings in the future.
--relinquish-privileges=username When tcpflow is run as root, this option changes the user ID and group ID to write files owned by username.  The group ID is the first one from the username groups list.  This operation is performed just after opening the capture device or just after opening the first input PCAP file.  This option does not support multi root-only readable input files as the root privileges are dropped after opening the first file (e.g.  -r root-only- access.pcap -R root-only.pcap -l root-only*.pcap).  This option has the same behaviour as the tcpdump(1) option having the same name --relinquish-privileges
-r     Read from file.  Read packets from file, which was created using the -w option of tcpdump(1).  This option may be repeated any number of times. Standard input is used if file is "-".  Note that for this option to be useful, tcpdump's -s option should be used to set the snaplen to the MTU of the interface (e.g., 1500) while capturing packets.
-R     Read from a file, but only to complete TCP flows. This option is used when tcpflow is used to process a series of files that are captured over time.  For each time period n, file  file(n).pcap should be processed with  -R file(n).pcap, while file(n-1).pcap should be processed with -r file(n-1).pcap.
-Sname=value Sets a name parameter to be equal to value for a plug-in.  Use -hh to find out all of the settable parameters.
-s     Strip non-printables.  Convert all non-printable characters to the "." character before printing packets to the console or storing them to a file.
-T[format] Specifies an arbitrary template for filenames.
%A     expands to source IP address.
%a     expands to source IP port.
%B     expands to destination IP address.
%b     expands to destination IP port.
%T     expands to timestamp in ISO8601 format.
%t     expands to timestamp in Unix time_t format.
%V     expands to "--" if a VLAN is present.
%v     expands to the VLAN number if a VLAN is present.
%C     expands to "c" if the connection count>0.
%c     expands to the connection count if the connection count>0.
%#     always expands to the connection count.
%N     (connection_number )             % 1000
%K     (connection_number / 1000)       % 1000
%M     (connection_number / 1000000)    % 1000
%G     (connection_number / 1000000000) % 1000
%%     prints a "%".
When the option -T is used, tcpflow ignores options -Fk, -Fm and -Fg. However, the option -T handles '/' within the filename template patern to create sub-directories.  For example the following line will create a directory tree out/IP-src/port-src/IP-dst/port-dst.
tcpflow -r packets.pcap -o out -T %A/%a/%B/%b/%c%N.flow
-V --version Print the version number and exit.
-v --verbose Verbose operation.  Verbosely describe tcpflow's operation. Equivalent to  -d 10.
-w filename.pcap Write packets that were not processed to filename.pcap. Typically this will be UDP packets.
-X filename.xml Write a DFXML report to filename.xml. The file contains a record of every tcp connection, how the tcpflow program was compiled, and the computer on which tcpflow was run.  By default tcpflow writes the DFXML report in file report.xml.
-Z     Don't decompress gzip-compressed streams.  -K Retain per flow isolated pcap structure.
expression selects which packets will be captured.  If no expression is given, all packets on the net will be captured.  Otherwise, only packets for which expression is `true' will be captured.
The expression argument can be passed to tcpflow as either a single Shell argument, or as multiple Shell arguments, whichever is more convenient.  Generally, if the expression contains Shell metacharacters, such as backslashes used to escape protocol names, it is easier to pass it as a single, quoted argument rather than to escape the Shell metacharacters.  Multiple arguments are concatenated with spaces before being parsed.
DFXML report The DFXML report is the XML file written by tcpflow to provide tcpflow build details, command line arguments and information about processed flows.
By default the DFXML file is named report.xml.  But this filename can be changed using command line option -X.
DFXML file respects the DFXML schema defined by project https://github.com/dfxml-working-group/dfxml_schema. Moreover tcpflow adds two extra XML tags, as illustrated by the following example:
<tcpflow startime='2017-07-22T00:12:21.962782Z' endtime='2017-07-22T00:12:22.097591Z' family='2' mac_daddr='40:3d:78:57:ed:d4' mac_saddr='00:c5:42:d2:cb:f2' src_ipn='141.134.34.12' dst_ipn='192.168.0.40' srcport='80' dstport='38797' packets='4' len='677' caplen='611' />
<tcpflow:result scanner="python" path="python/plugins" module="samplePlugin" function="sampleFunction">bla bla bla</tcpflow:result>
The first XML tag <tcpflow> provide information about the captured flow. This tag should be renamed <tcpflow:cap> in a future version in order to conform better to DFXML schema.
The second XML tag <tcpflow:result> collects processing results.  For the moment, only the scanner python uses this feature.
The XML attributes of <tcpflow> are:
•      startime Reception time of first packet
•      endtime Reception time of last packet
•      family
•      mac_daddr Destination MAC address of first packet (printed if any)
•      mac_saddr Source MAC address of first packet (printed if any)
•      src_ipn IP source
•      dst_ipn IP destination
•      srcport TCP port source
•      dstport TCP port destination
•      packets Nummber of packets
•      out_of_order_count Number of times tcpflow has replaced missing payload by zeros in the flow file, for example when capture does not contain the TCP session begin (printed if any)
•      violations Number of protocol violations (printed if any)
•      len Sum of un-truncated length of all packet data (including headers, see https://stackoverflow.com/q/1491660)
•      caplen Sum of captured bytes of all packet data (including headers, printed if different from len)
The XML attributes of <tcpflow:result> are:
•      scanner Name of the scanner
•      path Directory of the scanner module (printed if relevant)
•      module Module name (printed if relevant, used to indicate the python script)
•      function Function name (printed if relevant, used to indicate the function within the python module)
To record all packets arriving at or departing from sundown and extract all of the HTTP attachments: tcpflow -e http -o outdir host sundown
To record traffic between helios and either hot or ace and bin the results into 1000 files per directory and calculate the MD5 of each flow: tcpflow -X report.xml -e md5 -o outdir -Fk host helios and \( hot or ace \)
Please send bug reports to simsong@acm.org.
tcpflow currently does not understand IP fragments.  Flows containing IP fragments will not be recorded correctly.
Originally by Jeremy Elson <jelson@circlemud.org>.  Substantially modified and maintained by Simson L. Garfinkel <simsong@acm.org>. Network visualization code by Michael Shick <mike@shick.in>
The current version of this software is available at http://digitalcorpora.org/downloads/tcpflow/
An announcement mailing list for this program is at: http://groups.google.com/group/tcpflow-users
tcpdump(1), nit(4P), bpf(4), pcap(3), pcap-savefile(5), pcap-filter(7)
EXPECT(1)                    General Commands Manual                   EXPECT(1)
expect - programmed dialogue with interactive programs, Version 5
expect [ -dDinN ] [ -c cmds ] [ [ -[f|b] ] cmdfile ] [ args ]
Expect is a program that "talks" to other interactive programs according to a script.  Following the script, Expect knows what can be expected from a program and what the correct response should be.  An interpreted language provides branching and high-level control structures to direct the dialogue.  In addition, the user can take control and interact directly when desired, afterward returning control to the script.
Expectk is a mixture of Expect and Tk.  It behaves just like Expect and Tk's wish.  Expect can also be used directly in C or C++ (that is, without Tcl).  See libexpect(3).
The name "Expect" comes from the idea of send/expect sequences popularized by uucp, kermit and other modem control programs.  However unlike uucp, Expect is generalized so that it can be run as a user-level command with any program and task in mind.  Expect can actually talk to several programs at the same time.
For example, here are some things Expect can do:
•   Cause your computer to dial you back, so that you can login without paying for the call.
•   Start a game (e.g., rogue) and if the optimal configuration doesn't appear, restart it (again and again) until it does, then hand over control to you.
•   Run fsck, and in response to its questions, answer "yes", "no" or give control back to you, based on predetermined criteria.
•   Connect to another network or BBS (e.g., MCI Mail, CompuServe) and automatically retrieve your mail so that it appears as if it was originally sent to your local system.
•   Carry environment variables, current directory, or any kind of information across rlogin, telnet, tip, su, chgrp, etc.
There are a variety of reasons why the shell cannot perform these tasks. (Try, you'll see.)  All are possible with Expect.
In general, Expect is useful for running any program which requires interaction between the program and the user.  All that is necessary is that the interaction can be characterized programmatically.  Expect can also give the user back control (without halting the program being controlled) if desired.  Similarly, the user can return control to the script at any time.
Expect reads cmdfile for a list of commands to execute.  Expect may also be invoked implicitly on systems which support the #! notation by marking the script executable, and making the first line in your script:
#!/usr/local/bin/expect -f
Of course, the path must accurately describe where Expect lives. /usr/local/bin is just an example.
The -c flag prefaces a command to be executed before any in the script. The command should be quoted to prevent being broken up by the shell. This option may be used multiple times.  Multiple commands may be executed with a single -c by separating them with semicolons.  Commands are executed in the order they appear.  (When using Expectk, this option is specified as -command.)
The -d flag enables some diagnostic output, which primarily reports internal activity of commands such as expect and interact.  This flag has the same effect as "exp_internal 1" at the beginning of an Expect script, plus the version of Expect is printed.  (The strace command is useful for tracing statements, and the trace command is useful for tracing variable assignments.)  (When using Expectk, this option is specified as -diag.)
The -D flag enables an interactive debugger.  An integer value should follow.  The debugger will take control before the next Tcl procedure if the value is non-zero or if a ^C is pressed (or a breakpoint is hit, or other appropriate debugger command appears in the script).  See the README file or SEE ALSO (below) for more information on the debugger. (When using Expectk, this option is specified as -Debug.)
The -f flag prefaces a file from which to read commands from.  The flag itself is optional as it is only useful when using the #! notation (see above), so that other arguments may be supplied on the command line. (When using Expectk, this option is specified as -file.)
By default, the command file is read into memory and executed in its entirety.  It is occasionally desirable to read files one line at a time. For example, stdin is read this way.  In order to force arbitrary files to be handled this way, use the -b flag.  (When using Expectk, this option is specified as -buffer.)  Note that stdio-buffering may still take place however this shouldn't cause problems when reading from a fifo or stdin.
If the string "-" is supplied as a filename, standard input is read instead.  (Use "./-" to read from a file actually named "-".)
The -i flag causes Expect to interactively prompt for commands instead of reading them from a file.  Prompting is terminated via the exit command or upon EOF.  See interpreter (below) for more information.  -i is assumed if neither a command file nor -c is used.  (When using Expectk, this option is specified as -interactive.)
-- may be used to delimit the end of the options.  This is useful if you want to pass an option-like argument to your script without it being interpreted by Expect.  This can usefully be placed in the #! line to prevent any flag-like interpretation by Expect.  For example, the following will leave the original arguments (including the script name) in the variable argv.
#!/usr/local/bin/expect --
Note that the usual getopt(3) and execve(2) conventions must be observed when adding arguments to the #! line.
The file $exp_library/expect.rc is sourced automatically if present, unless the -N flag is used.  (When using Expectk, this option is specified as -NORC.)  Immediately after this, the file ~/.expect.rc is sourced automatically, unless the -n flag is used.  If the environment variable DOTDIR is defined, it is treated as a directory and .expect.rc is read from there.  (When using Expectk, this option is specified as -norc.)  This sourcing occurs only after executing any -c flags.
-v causes Expect to print its version number and exit.  (The corresponding flag in Expectk, which uses long flag names, is -version.)
Optional args are constructed into a list and stored in the variable named argv.  argc is initialized to the length of argv.
argv0 is defined to be the name of the script (or binary if no script is used).  For example, the following prints out the name of the script and the first three arguments:
send_user "$argv0 [lrange $argv 0 2]\n"
Expect uses Tcl (Tool Command Language).  Tcl provides control flow (e.g., if, for, break), expression evaluation and several other features such as recursion, procedure definition, etc.  Commands used here but not defined (e.g., set, if, exec) are Tcl commands (see tcl(3)).  Expect supports additional commands, described below.  Unless otherwise specified, commands return the empty string.
Commands are listed alphabetically so that they can be quickly located. However, new users may find it easier to start by reading the descriptions of spawn, send, expect, and interact, in that order.
Note that the best introduction to the language (both Expect and Tcl) is provided in the book "Exploring Expect" (see SEE ALSO below).  Examples are included in this man page but they are very limited since this man page is meant primarily as reference material.
Note that in the text of this man page, "Expect" with an uppercase "E" refers to the Expect program while "expect" with a lower-case "e" refers to the expect command within the Expect program.)
close [-slave] [-onexec 0|1] [-i spawn_id] closes the connection to the current process.  Most interactive programs will detect EOF on their stdin and exit; thus close usually suffices to kill the process as well.  The -i flag declares the process to close corresponding to the named spawn_id.
Both expect and interact will detect when the current process exits and implicitly do a close.  But if you kill the process by, say, "exec kill $pid", you will need to explicitly call close.
The -onexec flag determines whether the spawn id will be closed in any new spawned processes or if the process is overlayed.  To leave a spawn id open, use the value 0.  A non-zero integer value will force the spawn closed (the default) in any new processes.
The -slave flag closes the slave associated with the spawn id. (See "spawn -pty".)  When the connection is closed, the slave is automatically closed as well if still open.
No matter whether the connection is closed implicitly or explicitly, you should call wait to clear up the corresponding kernel process slot.  close does not call wait since there is no guarantee that closing a process connection will cause it to exit. See wait below for more info.
debug [[-now] 0|1] controls a Tcl debugger allowing you to step through statements, set breakpoints, etc.
With no arguments, a 1 is returned if the debugger is not running, otherwise a 0 is returned.
With a 1 argument, the debugger is started.  With a 0 argument, the debugger is stopped.  If a 1 argument is preceded by the -now flag, the debugger is started immediately (i.e., in the middle of the debug command itself).  Otherwise, the debugger is started with the next Tcl statement.
The debug command does not change any traps.  Compare this to starting Expect with the -D flag (see above).
See the README file or SEE ALSO (below) for more information on the debugger.
disconnect disconnects a forked process from the terminal.  It continues running in the background.  The process is given its own process group (if possible).  Standard I/O is redirected to /dev/null.
The following fragment uses disconnect to continue running the script in the background.
if {[fork]!=0} exit disconnect . . .
The following script reads a password, and then runs a program every hour that demands a password each time it is run.  The script supplies the password so that you only have to type it once.  (See the stty command which demonstrates how to turn off password echoing.)
send_user "password?\ " expect_user -re "(.*)\n" for {} 1 {} { if {[fork]!=0} {sleep 3600;continue} disconnect spawn priv_prog expect Password: send "$expect_out(1,string)\r" . . . exit }
An advantage to using disconnect over the shell asynchronous process feature (&) is that Expect can save the terminal parameters prior to disconnection, and then later apply them to new ptys. With &, Expect does not have a chance to read the terminal's parameters since the terminal is already disconnected by the time Expect receives control.
exit [-opts] [status] causes Expect to exit or otherwise prepare to do so.
The -onexit flag causes the next argument to be used as an exit handler.  Without an argument, the current exit handler is returned.
The -noexit flag causes Expect to prepare to exit but stop short of actually returning control to the operating system.  The user- defined exit handler is run as well as Expect's own internal handlers.  No further Expect commands should be executed.  This is useful if you are running Expect with other Tcl extensions.  The current interpreter (and main window if in the Tk environment) remain so that other Tcl extensions can clean up.  If Expect's exit is called again (however this might occur), the handlers are not rerun.
Upon exiting, all connections to spawned processes are closed. Closure will be detected as an EOF by spawned processes.  exit takes no other actions beyond what the normal _exit(2) procedure does.  Thus, spawned processes that do not check for EOF may continue to run.  (A variety of conditions are important to determining, for example, what signals a spawned process will be sent, but these are system-dependent, typically documented under exit(3).)  Spawned processes that continue to run will be inherited by init.
status (or 0 if not specified) is returned as the exit status of Expect.  exit is implicitly executed if the end of the script is reached.
exp_continue [-continue_timer] The command exp_continue allows expect itself to continue executing rather than returning as it normally would. By default exp_continue resets the timeout timer. The -continue_timer flag prevents timer from being restarted. (See expect for more information.)
exp_internal [-f file] value causes further commands to send diagnostic information internal to Expect to stderr if value is non-zero.  This output is disabled if value is 0.  The diagnostic information includes every character received, and every attempt made to match the current output against the patterns.
If the optional file is supplied, all normal and debugging output is written to that file (regardless of the value of value).  Any previous diagnostic output file is closed.
The -info flag causes exp_internal to return a description of the most recent non-info arguments given.
exp_open [args] [-i spawn_id] returns a Tcl file identifier that corresponds to the original spawn id.  The file identifier can then be used as if it were opened by Tcl's open command.  (The spawn id should no longer be used.  A wait should not be executed.
The -leaveopen flag leaves the spawn id open for access through Expect commands.  A wait must be executed on the spawn id.
exp_pid [-i spawn_id] returns the process id corresponding to the currently spawned process.  If the -i flag is used, the pid returned corresponds to that of the given spawn id.
exp_send is an alias for send.
exp_send_error is an alias for send_error.
exp_send_log is an alias for send_log.
exp_send_tty is an alias for send_tty.
exp_send_user is an alias for send_user.
exp_version [[-exit] version] is useful for assuring that the script is compatible with the current version of Expect.
With no arguments, the current version of Expect is returned.  This version may then be encoded in your script.  If you actually know that you are not using features of recent versions, you can specify an earlier version.
Versions consist of three numbers separated by dots.  First is the major number.  Scripts written for versions of Expect with a different major number will almost certainly not work.  exp_version returns an error if the major numbers do not match.
Second is the minor number.  Scripts written for a version with a greater minor number than the current version may depend upon some new feature and might not run.  exp_version returns an error if the major numbers match, but the script minor number is greater than that of the running Expect.
Third is a number that plays no part in the version comparison. However, it is incremented when the Expect software distribution is changed in any way, such as by additional documentation or optimization.  It is reset to 0 upon each new minor version.
With the -exit flag, Expect prints an error and exits if the version is out of date.
expect [[-opts] pat1 body1] ... [-opts] patn [bodyn] waits until one of the patterns matches the output of a spawned process, a specified time period has passed, or an end-of-file is seen.  If the final body is empty, it may be omitted.
Patterns from the most recent expect_before command are implicitly used before any other patterns.  Patterns from the most recent expect_after command are implicitly used after any other patterns.
If the arguments to the entire expect statement require more than one line, all the arguments may be "braced" into one so as to avoid terminating each line with a backslash.  In this one case, the usual Tcl substitutions will occur despite the braces.
If a pattern is the keyword eof, the corresponding body is executed upon end-of-file.  If a pattern is the keyword timeout, the corresponding body is executed upon timeout.  If no timeout keyword is used, an implicit null action is executed upon timeout.  The default timeout period is 10 seconds but may be set, for example to 30, by the command "set timeout 30".  An infinite timeout may be designated by the value -1.  If a pattern is the keyword default, the corresponding body is executed upon either timeout or end-of- file.
If a pattern matches, then the corresponding body is executed. expect returns the result of the body (or the empty string if no pattern matched).  In the event that multiple patterns match, the one appearing first is used to select a body.
Each time new output arrives, it is compared to each pattern in the order they are listed.  Thus, you may test for absence of a match by making the last pattern something guaranteed to appear, such as a prompt.  In situations where there is no prompt, you must use timeout (just like you would if you were interacting manually).
Patterns are specified in three ways.  By default, patterns are specified as with Tcl's string match command.  (Such patterns are also similar to C-shell regular expressions usually referred to as "glob" patterns).  The -gl flag may may be used to protect patterns that might otherwise match expect flags from doing so.  Any pattern beginning with a "-" should be protected this way.  (All strings starting with "-" are reserved for future options.)
For example, the following fragment looks for a successful login. (Note that abort is presumed to be a procedure defined elsewhere in the script.)
expect { busy               {puts busy\n ; exp_continue} failed             abort "invalid password" abort timeout            abort connected }
Quotes are necessary on the fourth pattern since it contains a space, which would otherwise separate the pattern from the action. Patterns with the same action (such as the 3rd and 4th) require listing the actions again.  This can be avoid by using regexp-style patterns (see below).  More information on forming glob-style patterns can be found in the Tcl manual.
Regexp-style patterns follow the syntax defined by Tcl's regexp (short for "regular expression") command.  regexp patterns are introduced with the flag -re.  The previous example can be rewritten using a regexp as:
expect { busy       {puts busy\n ; exp_continue} -re "failed|invalid password" abort timeout    abort connected }
Both types of patterns are "unanchored".  This means that patterns do not have to match the entire string, but can begin and end the match anywhere in the string (as long as everything else matches). Use ^ to match the beginning of a string, and $ to match the end. Note that if you do not wait for the end of a string, your responses can easily end up in the middle of the string as they are echoed from the spawned process.  While still producing correct results, the output can look unnatural.  Thus, use of $ is encouraged if you can exactly describe the characters at the end of a string.
Note that in many editors, the ^ and $ match the beginning and end of lines respectively. However, because expect is not line oriented, these characters match the beginning and end of the data (as opposed to lines) currently in the expect matching buffer. (Also, see the note below on "system indigestion.")
The -ex flag causes the pattern to be matched as an "exact" string. No interpretation of *, ^, etc is made (although the usual Tcl conventions must still be observed).  Exact patterns are always unanchored.
The -nocase flag causes uppercase characters of the output to compare as if they were lowercase characters.  The pattern is not affected.
While reading output, more than 2000 bytes can force earlier bytes to be "forgotten".  This may be changed with the function match_max.  (Note that excessively large values can slow down the pattern matcher.)  If patlist is full_buffer, the corresponding body is executed if match_max bytes have been received and no other patterns have matched.  Whether or not the full_buffer keyword is used, the forgotten characters are written to expect_out(buffer).
If patlist is the keyword null, and nulls are allowed (via the remove_nulls command), the corresponding body is executed if a single ASCII 0 is matched.  It is not possible to match 0 bytes via glob or regexp patterns.
Upon matching a pattern (or eof or full_buffer), any matching and previously unmatched output is saved in the variable expect_out(buffer).  Up to 9 regexp substring matches are saved in the variables expect_out(1,string) through expect_out(9,string). If the -indices flag is used before a pattern, the starting and ending indices (in a form suitable for lrange) of the 10 strings are stored in the variables expect_out(X,start) and expect_out(X,end) where X is a digit, corresponds to the substring position in the buffer.  0 refers to strings which matched the entire pattern and is generated for glob patterns as well as regexp patterns.  For example, if a process has produced output of "abcdefgh\n", the result of:
expect "cd"
is as if the following statements had executed:
set expect_out(0,string) cd set expect_out(buffer) abcd
and "efgh\n" is left in the output buffer.  If a process produced the output "abbbcabkkkka\n", the result of:
expect -indices -re "b(b*).*(k+)"
set expect_out(0,start) 1 set expect_out(0,end) 10 set expect_out(0,string) bbbcabkkkk set expect_out(1,start) 2 set expect_out(1,end) 3 set expect_out(1,string) bb set expect_out(2,start) 10 set expect_out(2,end) 10 set expect_out(2,string) k set expect_out(buffer) abbbcabkkkk
and "a\n" is left in the output buffer.  The pattern "*" (and -re ".*") will flush the output buffer without reading any more output from the process.
Normally, the matched output is discarded from Expect's internal buffers.  This may be prevented by prefixing a pattern with the -notransfer flag.  This flag is especially useful in experimenting (and can be abbreviated to "-not" for convenience while experimenting).
The spawn id associated with the matching output (or eof or full_buffer) is stored in expect_out(spawn_id).
The -timeout flag causes the current expect command to use the following value as a timeout instead of using the value of the timeout variable.
By default, patterns are matched against output from the current process, however the -i flag declares the output from the named spawn_id list be matched against any following patterns (up to the next -i).  The spawn_id list should either be a whitespace separated list of spawn_ids or a variable referring to such a list of spawn_ids.
For example, the following example waits for "connected" from the current process, or "busy", "failed" or "invalid password" from the spawn_id named by $proc2.
expect { -i $proc2 busy {puts busy\n ; exp_continue} -re "failed|invalid password" abort timeout abort connected }
The value of the global variable any_spawn_id may be used to match patterns to any spawn_ids that are named with all other -i flags in the current expect command.  The spawn_id from a -i flag with no associated pattern (i.e., followed immediately by another -i) is made available to any other patterns in the same expect command associated with any_spawn_id.
The -i flag may also name a global variable in which case the variable is read for a list of spawn ids.  The variable is reread whenever it changes.  This provides a way of changing the I/O source while the command is in execution.  Spawn ids provided this way are called "indirect" spawn ids.
Actions such as break and continue cause control structures (i.e., for, proc) to behave in the usual way.  The command exp_continue allows expect itself to continue executing rather than returning as it normally would.
This is useful for avoiding explicit loops or repeated expect statements.  The following example is part of a fragment to automate rlogin.  The exp_continue avoids having to write a second expect statement (to look for the prompt again) if the rlogin prompts for a password.
expect { Password: { stty -echo send_user "password (for $user) on $host: " expect_user -re "(.*)\n" send_user "\n" send "$expect_out(1,string)\r" stty echo exp_continue } incorrect { send_user "invalid password or account\n" exit } timeout { send_user "connection to $host timed out\n" exit } eof { send_user \ "connection to host failed: $expect_out(buffer)" exit } -re $prompt }
For example, the following fragment might help a user guide an interaction that is already totally automated.  In this case, the terminal is put into raw mode.  If the user presses "+", a variable is incremented.  If "p" is pressed, several returns are sent to the process, perhaps to poke it in some way, and "i" lets the user interact with the process, effectively stealing away control from the script.  In each case, the exp_continue allows the current expect to continue pattern matching after executing the current action.
stty raw -echo expect_after { -i $user_spawn_id "p" {send "\r\r\r"; exp_continue} "+" {incr foo; exp_continue} "i" {interact; exp_continue} "quit" exit }
By default, exp_continue resets the timeout timer.  The timer is not restarted, if exp_continue is called with the -continue_timer flag.
expect_after [expect_args] works identically to the expect_before except that if patterns from both expect and expect_after can match, the expect pattern is used. See the expect_before command for more information.
expect_background [expect_args] takes the same arguments as expect, however it returns immediately. Patterns are tested whenever new input arrives.  The pattern timeout and default are meaningless to expect_background and are silently discarded.  Otherwise, the expect_background command uses expect_before and expect_after patterns just like expect does.
When expect_background actions are being evaluated, background processing for the same spawn id is blocked.  Background processing is unblocked when the action completes.  While background processing is blocked, it is possible to do a (foreground) expect on the same spawn id.
It is not possible to execute an expect while an expect_background is unblocked.  expect_background for a particular spawn id is deleted by declaring a new expect_background with the same spawn id.  Declaring expect_background with no pattern removes the given spawn id from the ability to match patterns in the background.
expect_before [expect_args] takes the same arguments as expect, however it returns immediately. Pattern-action pairs from the most recent expect_before with the same spawn id are implicitly added to any following expect commands.  If a pattern matches, it is treated as if it had been specified in the expect command itself, and the associated body is executed in the context of the expect command.  If patterns from both expect_before and expect can match, the expect_before pattern is used.
If no pattern is specified, the spawn id is not checked for any patterns.
Unless overridden by a -i flag, expect_before patterns match against the spawn id defined at the time that the expect_before command was executed (not when its pattern is matched).
The -info flag causes expect_before to return the current specifications of what patterns it will match.  By default, it reports on the current spawn id.  An optional spawn id specification may be given for information on that spawn id.  For example
expect_before -info -i $proc
At most one spawn id specification may be given.  The flag -indirect suppresses direct spawn ids that come only from indirect specifications.
Instead of a spawn id specification, the flag "-all" will cause "-info" to report on all spawn ids.
The output of the -info flag can be reused as the argument to expect_before.
expect_tty [expect_args] is like expect but it reads characters from /dev/tty (i.e. keystrokes from the user).  By default, reading is performed in cooked mode.  Thus, lines must end with a return in order for expect to see them.  This may be changed via stty (see the stty command below).
expect_user [expect_args] is like expect but it reads characters from stdin (i.e. keystrokes from the user).  By default, reading is performed in cooked mode. Thus, lines must end with a return in order for expect to see them. This may be changed via stty (see the stty command below).
fork  creates a new process.  The new process is an exact copy of the current Expect process.  On success, fork returns 0 to the new (child) process and returns the process ID of the child process to the parent process.  On failure (invariably due to lack of resources, e.g., swap space, memory), fork returns -1 to the parent process, and no child process is created.
Forked processes exit via the exit command, just like the original process.  Forked processes are allowed to write to the log files. If you do not disable debugging or logging in most of the processes, the result can be confusing.
Some pty implementations may be confused by multiple readers and writers, even momentarily.  Thus, it is safest to fork before spawning processes.
interact [string1 body1] ... [stringn [bodyn]] gives control of the current process to the user, so that keystrokes are sent to the current process, and the stdout and stderr of the current process are returned.
String-body pairs may be specified as arguments, in which case the body is executed when the corresponding string is entered.  (By default, the string is not sent to the current process.)   The interpreter command is assumed, if the final body is missing.
If the arguments to the entire interact statement require more than one line, all the arguments may be "braced" into one so as to avoid terminating each line with a backslash.  In this one case, the usual Tcl substitutions will occur despite the braces.
For example, the following command runs interact with the following string-body pairs defined:  When ^Z is pressed, Expect is suspended.  (The -reset flag restores the terminal modes.)  When ^A is pressed, the user sees "you typed a control-A" and the process is sent a ^A.  When $ is pressed, the user sees the date.  When ^C is pressed, Expect exits.  If "foo" is entered, the user sees "bar".  When ~~ is pressed, the Expect interpreter runs interactively.
set CTRLZ \032 interact { -reset $CTRLZ {exec kill -STOP [pid]} \001   {send_user "you typed a control-A\n"; send "\001" } $      {send_user "The date is [clock format [clock seconds]]."} \003   exit foo    {send_user "bar"} ~~ }
In string-body pairs, strings are matched in the order they are listed as arguments.  Strings that partially match are not sent to the current process in anticipation of the remainder coming.  If characters are then entered such that there can no longer possibly be a match, only the part of the string will be sent to the process that cannot possibly begin another match.  Thus, strings that are substrings of partial matches can match later, if the original strings that was attempting to be match ultimately fails.
By default, string matching is exact with no wild cards.  (In contrast, the expect command uses glob-style patterns by default.) The -ex flag may be used to protect patterns that might otherwise match interact flags from doing so.  Any pattern beginning with a "-" should be protected this way.    (All strings starting with "-" are reserved for future options.)