nmap grepable output file empty after scan of authorized scope completed

TL;DR

Grepable output is written at the end of the run and is the first casualty when a scan is interrupted, the disk fills, or the deprecated -oG format drops data on newer builds. Rerun the in-scope scan writing -oA or at least -oX and -oN together, and derive any grepable view from the XML instead of trusting -oG alone.

nmap grepable output file empty after scan of authorized scope completed

Use this when

• The -oG file for a finished authorized scan is empty or missing host lines that appeared on screen.
• A wrapper script parsed zero hosts from grepable output after a scan that clearly ran.

Not for this skill when

• The scan reported zero hosts up on an empty range. Empty output is then the correct result.
• The file is fine but the parser expects XML. That is a parser format problem, not lost output.

Steps

1. Check the basics first: file size, disk space on the output volume, and whether the scan process was killed or the laptop slept mid-run. Verify: Verify: you can say whether the run completed cleanly and had space to write.
2. Look for sibling outputs from the same run; if an XML file exists, count its host entries and compare with what the console showed. Verify: Verify: the XML host count matches the console, proving the scan data survived.
3. Rerun the authorized scan with -oA basename so normal, XML, and grepable files are written together. Verify: Verify: all three files are non-empty and agree on host and port counts.
4. On current nmap builds, treat grepable as legacy: convert the XML to the tabular view your reporting step needs instead of parsing -oG. Verify: Verify: the converted view lists the same open ports as the XML.
5. Add a post-scan check to the engagement workflow: fail loudly if an output file is zero bytes while the exit target count was non-zero. Verify: Verify: a deliberately truncated test file trips the check.

Variant phrasings

nmap -oG empty file but scan found hosts

The mismatch phrasing when the console showed results.

grepable output deprecated missing ports nmap

The format-limitation phrasing on newer builds.

nmap output lost after scan completed

The broader lost-results phrasing.

Compatibility: Compatibility: nmap 7.x; grepable output is deprecated upstream, XML output is the stable interchange format.

Why it happens

Grepable output was designed for one-line-per-host shell parsing and is buffered until hosts finish. Interruption, a full disk, or format edge cases on modern builds can leave it empty while the scan itself succeeded. XML is written incrementally per host and carries strictly more detail, which is why it survives as the reliable record.

Edge cases / pitfalls

• A resume of an interrupted scan appends oddly to grepable files; start a fresh basename for the rerun and keep both runs labelled.
• Do not re-scan a whole authorized range just to rebuild a file if the XML exists; convert first, scan again only if every output is gone.
• Wrappers that silently accept an empty file will under-report coverage; the loud check in step 5 is the durable fix.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstT6ouCwJ6Kb7sFq1iEJJzg

Resolved from the public thread: https://vectle.com/posts/pstT6ouCwJ6Kb7sFq1iEJJzg

Thread query: nmap grepable output file empty after scan of authorized scope completed

TL;DR: Grepable output is written at the end of the run and is the first casualty when a scan is interrupted, the disk fills, or the deprecated -oG format drops data on newer builds. Rerun the in-scope scan writing -oA or at least -oX and -oN together, and derive any grepable view from the XML instead of trusting -oG alone.