Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a huge webserver access.log in CentOS. I access it over remote VPN so I cant copy the file or read it directly.

I know the specific time in the logs I want to copy, but it is too far back too easily copy a tail of the log to a text file. Here is what a line of the log looks like.

10.255.16.203 - - [26/Mar/2014:16:35:13 +0000]

So my question is : How can I copy a specific section of a very large log if I know the time strings I want to find?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The grep command is designed to show only matching lines of a given files. With the use of -C option it is possible to show not only the matching line(s) but some lines before and after it.

So to have the 3 lines before and after the line you want:

$ grep -C 3 "26/Mar/2014:16:35:13 +0000" access.log

You can also tune more precisely the number of lines displayed after and/or before the matching lines with the -A and -B options. In fact -C 3 is the same as -A 3 -B 3.

If there are more than one matching line, then grep would display the 3 lines before and after the matched lines block.

Example:

$ grep -C 3 "25/Mar/2014:10:40:59 +0100" access.log
10.0.0.44 - httpuse [25/Mar/2014:09:41:17 +0100] "GET /dummy/BIGDummy_133644_1565_DL.xml.gz HTTP/1.1" 200 507 "-" "-"
10.0.0.43 - httpuse [25/Mar/2014:09:59:51 +0100] "GET /dummy/BIGDummy_133647_48267_DL.xml.gz HTTP/1.1" 200 1677 "-" "-"
10.0.0.44 - httpuse [25/Mar/2014:10:40:42 +0100] "GET /dummy/BIGDummy_133664_39603_DL.xml.gz HTTP/1.1" 200 1677 "-" "-"
10.0.0.40 - httpuse [25/Mar/2014:10:40:59 +0100] "GET /dummy/BIGDummy_133664_DL.xml.gz HTTP/1.1" 200 60142 "-" "-"
10.0.0.41 - httpuse [25/Mar/2014:10:40:59 +0100] "GET /dummy/BIGDummy_133667_23124_DL.xml.gz HTTP/1.1" 200 5202 "-" "-"
10.0.0.40 - httpuse [25/Mar/2014:10:43:09 +0100] "GET /dummy/BIGDummy_133668_46_DL.xml.gz HTTP/1.1" 200 445 "-" "-"
10.0.0.42 - httpuse [25/Mar/2014:10:43:10 +0100] "GET /dummy/BIGDummy_133668_4116_DL.xml.gz HTTP/1.1" 200 597 "-" "-"
10.0.0.40 - httpuse [25/Mar/2014:10:43:13 +0100] "GET /dummy/BIGDummy_133665_DL.xml.gz HTTP/1.1" 200 57902 "-" "-"

From man grep:

NAME
   grep, egrep, fgrep - print lines matching a pattern

SYNOPSIS
   grep [options] PATTERN [FILE...]

DESCRIPTION
   Grep  searches  the  named  input  FILEs (or standard input if no files are named,
    or the file name - is given) for lines containing a match to the given PATTERN.
   By default, grep prints the matching lines.

OPTIONS
    -A NUM, --after-context=NUM
            Print  NUM  lines  of  trailing context after matching lines.
            Places a line containing -- between contiguous groups of matches.

    -B NUM, --before-context=NUM
            Print NUM lines of leading context before matching lines.
            Places a line containing --  between  contiguous  groups  of matches.

    -C NUM, --context=NUM
            Print  NUM  lines  of  output  context.
            Places a line containing -- between contiguous groups of matches.
share|improve this answer
    
Thanks, I would never have got that from the man page description. –  blarg Mar 27 at 10:29
1  
Also -A would be useful to copy lines after a specific date and -B for before. –  Graeme Mar 27 at 11:42
    
In fact -C 3 is the same as -A 3 -B 3. But sure, with the options you can tune the context display more precisely. –  Ouki Mar 27 at 11:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.