Neil Symons is rumoured to have said: >tail -f /var/log/syslog |grep auth"\|"pop"\|"imap Almost the same; I use grep -E "auth|pop|imap" /var/log/syslog for that kinda thing. Or awk. I suspect grep is one of those commands that tends to get over-used :-)