5

I'm working in Unix.

I'd like to fetch information from a log in a specified time range for the current date. For example I want the data from a log file of today's date from 00:00 to 09:00.

Sample log entry:

13/10/16 14:45:02 <batchspeedchange> <BELLBD.BD77350A.G6987V00> <> FAILED FILE FORMAT VALIDATION - ERROR:-213:rawData cannot contain tokens

How do I get the output from such a log file?

Improve this question
4
  • 6
    Would you show us what the log file looks like?
    – rickhg12hs
    Oct 28, 2013 at 16:36
  • 1
    Are the times included in the log?
    – terdon ♦
    Oct 28, 2013 at 16:38
  • Hi terdon, yes the times were included in the log
    – Gopalakrishnan
    Oct 28, 2013 at 17:58
  • 13/10/16 14:45:02 <batchspeedchange> <BELLBD.BD77350A.G6987V00> <> FAILED FILE FORMAT VALIDATION - ERROR:-213:rawData cannot contain tokens
    – Gopalakrishnan
    Oct 28, 2013 at 18:00

2 Answers 2

Reset to default
7

Assuming the dates look like "HH:MM" as you've show, and assuming the date appears in the 2nd field, you can use awk:

awk -v start=00:00 -v stop=09:00 'start <= $2 && $2 < stop' file.log

[rant] I'm quite particular about date formatting, and this one is terrible: what date is "09/10/11"? [/rant]

Anyway, assuming this it "YY/MM/DD"

awk -v date="$(date +%y/%m/%d)" \
    -v start=00:00:00 \
    -v stop=09:00:00 \
    -v search="File format not found" \
'$1 == date && start <= $2 && $2 < stop && $0 ~ search' file.log
Improve this answer
3
  • hi glenn, im getting the output for previous dates also from the log file. I want the output only from the current date. And also it was more helpful for me if i get the desired pattern. For example : if i want to search the pattern called "File format not found" i have to get this pattern from the currents date(ie.., today) with in a specific time range. It will be more helpful for me if u give the output.
    – Gopalakrishnan
    Oct 28, 2013 at 17:49
  • It will be helpful is you show us an example of the log file format.
    – glenn jackman
    Oct 28, 2013 at 17:55
  • Hi glenn, thank u for ur quick response. The below was the error what we have to fetch. For Ex :"13/10/16 14:45:02 <batchspeedchange> <BELLBD.BD77350A.G6987V00> <> FAILED FILE FORMAT VALIDATION - ERROR:-213:rawData cannot contain tokens".
    – Gopalakrishnan
    Oct 28, 2013 at 17:57
0

Assuming the lines in the log file are in chronological order, and that there IS an event at 00:00 and 00:09:

awk '/^13\/10\/16 00:00/,/^13\/10\/16 09:00/ {print}' file.log

I find the above easy to remember and a great tool when investigating logs. The assumptions are too broad for production use.

Improve this answer
4
  • hi dan,thanks for ur response. But i want it for the current date. If u can, please respond to this. So, that i can put this in script and search the files every day
    – Gopalakrishnan
    Oct 28, 2013 at 20:44
  • 1
    This also assumes that the exact times 00:00 and 09:00 appear in the log file, which is a rather unsafe assumption.
    – Joseph R.
    Oct 28, 2013 at 22:50
  • @JosephR. You are certainly correct. But for scripts it is easy to remember and immediately detectable when it fails.
    – Dan Garthwaite
    Oct 29, 2013 at 14:25
  • 1
    @Gopalakrishnan The unix date command is wonderfully expressive, but if you are automating this in production the above assumption will eventually trip you up. Go with Glen Jackman's answer and just set the search value to the empty string, or drop it altogether.
    – Dan Garthwaite
    Oct 29, 2013 at 14:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .