# Count all lines with sshd[ in them: grep ' sshd\[' messages.1 | wc -l # Count only the lines with sshd[ and 'password' in them grep ' sshd\[' messages.1 | grep password | wc -l