NAME
slowedit find - search the database for particular events

SYNOPSIS

DESCRIPTION
slowedit find serches the database for events that match the pattern specified. The pattern is composed of items from the standard event set.

The two-letter event items may be specified as being less-than (e.g. er<value), greater-than (e.g. er<value), or equal-to (e.g. er=value) to a specified value. For example, the following will search for, and print, all records with more than 300 envelope recipients:

Note that the pattern should be quoted to supress the special meaning of > and < to the shell.

Three-letter (boolean) event items are specified by entering the item name, followed by an equal sign, and then one of three keyworks: set, clear, or only. The set keyword means you want to find all records with that item set (TRUE). The clear means you want to find all records with that item clear (FALSE). And only means that of all the boolean items, this will be the only one set (the only one TRUE).

To illustrate consider the desire to find all record that were not recived on an network interface and for which sendmail aborted:

Note that, unless you specify otherwise with an or keyword, the search will only return records that match all (logical AND) the items specified. Thus, to perform the first search above, where either item may be set, you would use the or prefix like this:
Even though the default is a logical AND, an and prefix is also available, but optional:
The text portion of the Message-Id: header's value may also be searched using extended regular expressions. For example, the following will search for all records from microsoft.com:
Because all searches are case insensitive there is no need to specify case in your search.

Because find searches the entire database for arbitray patterns, the search can become quite slow as the database grows.

There is currently no way to search by date or IP number.