2

I have a 400MB+ Tomcat log file (catalina.out). How can I pull out entries for a given time period?

4

Not sure if this would work well for your 400MB file, but here are some CLI one liners that would do the trick.

If you're looking for entries for a specific date, grep -c can probably do what you need.

Otherwise, you could probably use sed:

sed -n '/date1/,/date2/p' filename

For example with an input file "test":

Day 0: foo
Day 1: hello
Day 2: world
Day 3: blah

You could run

[me@mybox tmp]$ sed -n '/Day 1/,/Day 2/p' test
Day 1: hello
Day 2: world
  • This will output nothing if no line contains the start date and will output until the end of file if no line contains the end date. The absence of a date may be caused by server down, no event or log rotation. So I would not count on every date's presence. – manatwork Apr 27 '12 at 10:29
  • 1
    True, but this is about as simple as you can get without parsing the dates and figuring out when you've crossed. My assumption was that with a 400MB log files, rotation might not be an issue and there's probably events close to your area of interest. For the rotation problem at least, there's always cat, zcat, etc... – zje Apr 27 '12 at 14:56
0

Consider using tools such as splunk, loglogic, logrhythm, graylog2.org(opensource)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.