I am trying to show all instances of a particular message from the syslog in chronological order by doing something like the following:

grep squiggle /var/log/messages*

Unfortunately the glob pattern matches the currently active file first. eg.


This means that recent messages show up first followed by the historical messages in chronological order.

Is it possible to adjust the glob pattern behaviour somehow to make the empty match (ie. just messages) show up at the end of the list?

If not, what would be a good way to address this problem?

  • 2
    You could reverse output using tac: grep squiggle /var/log/messages* | tac... – pbm Mar 13 '12 at 10:17

I don't know of a way to change the globbing order, but there's an easy workaround for your case:

grep squiggle /var/log/messages-* /var/log/messages

i.e. don't match the messages files in your glob pattern, and add it to the end of grep's argument list.

  • Thanks for that. Been making the problem more complex than it needed to be! – Burhan Ali Mar 13 '12 at 12:28
  • 1
    Or for extra fanciness and less redundancy, use grep squiggle /var/log/messages{-*,}. (Called "bash brace expansion" if you want to google it.) – Wildcard Sep 23 '16 at 0:32

In zsh, you can control the order of matches (among other things) with a glob qualifier.

echo /var/log/messages*        # usual lexicographic order
echo /var/log/messages*(On)    # reverse lexicographic order
echo /var/log/messages*(om)    # reverse chronological order (ascending mtime)
echo /var/log/messages*(Om)    # chronological order order (descending mtime)

(See the manual for more possibilities.) You can even define your own sorting order by supplying a comparison function in recent versions, with oe or o+.

Here, the proper order of files is chronological order. You can emulate it easily based on the name, though, and that works even in bash:

grep squiggle /var/log/messages{-*,}
  • I'm increasingly impressed by zsh the more I read about it. – Burhan Ali Mar 14 '12 at 10:20
  • Can I get files (in order) from zsh and pass them back to bash? – Wowfunhappy Jan 20 '19 at 20:26
  • @Wowfunhappy Yes but you need to be careful to treat special characters correctly. Ask a new question. – Gilles 'SO- stop being evil' Jan 21 '19 at 8:24

You can use backticks combined with ls -tr (sort by mod time and in reverse) like this:

grep squiggle `ls -tr /var/log/messages*`

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.