2

I have a 400MB+ Tomcat log file (catalina.out). How can I pull out entries for a given time period?

2 Answers 2

4

Not sure if this would work well for your 400MB file, but here are some CLI one liners that would do the trick.

If you're looking for entries for a specific date, grep -c can probably do what you need.

Otherwise, you could probably use sed:

sed -n '/date1/,/date2/p' filename

For example with an input file "test":

Day 0: foo
Day 1: hello
Day 2: world
Day 3: blah

You could run

[me@mybox tmp]$ sed -n '/Day 1/,/Day 2/p' test
Day 1: hello
Day 2: world
2
  • This will output nothing if no line contains the start date and will output until the end of file if no line contains the end date. The absence of a date may be caused by server down, no event or log rotation. So I would not count on every date's presence.
    – manatwork
    Apr 27, 2012 at 10:29
  • 1
    True, but this is about as simple as you can get without parsing the dates and figuring out when you've crossed. My assumption was that with a 400MB log files, rotation might not be an issue and there's probably events close to your area of interest. For the rotation problem at least, there's always cat, zcat, etc...
    – zje
    Apr 27, 2012 at 14:56
0

Consider using tools such as splunk, loglogic, logrhythm, graylog2.org(opensource)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .