How can I get entries for a given time period from a 400MB+ log file?

Question

I have a 400MB+ Tomcat log file (catalina.out). How can I pull out entries for a given time period?

zestrada · Accepted Answer · 2012-04-26 22:01:58Z

up vote 2 down vote accepted

Not sure if this would work well for your 400MB file, but here are some CLI one liners that would do the trick.

If you're looking for entries for a specific date, grep -c can probably do what you need.

Otherwise, you could probably use sed:

sed -n '/date1/,/date2/p' filename

For example with an input file "test":

Day 0: foo
Day 1: hello
Day 2: world
Day 3: blah

You could run

[me@mybox tmp]$ sed -n '/Day 1/,/Day 2/p' test
Day 1: hello
Day 2: world

edited Apr 26 '12 at 22:01

answered Apr 26 '12 at 21:56

zestrada
54316

	This will output nothing if no line contains the start date and will output until the end of file if no line contains the end date. The absence of a date may be caused by server down, no event or log rotation. So I would not count on every date's presence. – manatwork Apr 27 '12 at 10:29
	True, but this is about as simple as you can get without parsing the dates and figuring out when you've crossed. My assumption was that with a 400MB log files, rotation might not be an issue and there's probably events close to your area of interest. For the rotation problem at least, there's always `cat`, `zcat`, etc... – zestrada Apr 27 '12 at 14:56

c0mrade · Answer 2 · 2012-04-26 17:24:55Z

up vote 0 down vote

answered Apr 26 '12 at 17:24

c0mrade
22417

2 Answers