1

I have a bash command (on macOS High Sierra) as:

 sudo cat /private/var/log/system.log*| awk 'BEGIN {print "\n"} {print "Month\tDay\tTime\t\tSystemMessage"} /SHUTDOWN_TIME/{print $1,$2,$3,$8}'|sort -M|uniq|column -t

Output:

Month  Day  Time      SystemMessage
Mar    30   02:50:56  SHUTDOWN_TIME:
Mar    30   13:13:28  SHUTDOWN_TIME:
Apr    1    17:27:48  SHUTDOWN_TIME:
Apr    1    23:59:37  SHUTDOWN_TIME:
Apr    10   17:08:10  SHUTDOWN_TIME:
Apr    10   22:59:13  SHUTDOWN_TIME:
Apr    11   19:13:43  SHUTDOWN_TIME:
Apr    2    16:33:50  SHUTDOWN_TIME:
Apr    3    00:13:58  SHUTDOWN_TIME:
Apr    3    16:54:22  SHUTDOWN_TIME:
Apr    3    23:36:55  SHUTDOWN_TIME:
Apr    4    17:00:40  SHUTDOWN_TIME:
Apr    5    17:00:50  SHUTDOWN_TIME:
Apr    8    17:41:18  SHUTDOWN_TIME:
Apr    8    23:41:05  SHUTDOWN_TIME:
Apr    9    17:19:33  SHUTDOWN_TIME:
Apr    9    23:23:18  SHUTDOWN_TIME:

While I have another bash command setup as :

sudo cat /private/var/log/system.log*| awk 'BEGIN {print "\n"} {print "Month\tDay\tTime\t\tSystemMessage"} /BOOT_TIME/{print $1,$2,$3,$6}'|sort -M|uniq|column -t

Output:

Month  Day  Time      SystemMessage
Mar    30   12:37:12  BOOT_TIME
Apr    1    10:09:12  BOOT_TIME
Apr    1    21:45:41  BOOT_TIME
Apr    10   09:38:12  BOOT_TIME
Apr    10   19:53:06  BOOT_TIME
Apr    11   12:02:02  BOOT_TIME
Apr    12   09:33:21  BOOT_TIME
Apr    2    10:19:19  BOOT_TIME
Apr    2    22:54:34  BOOT_TIME
Apr    3    09:56:02  BOOT_TIME
Apr    3    21:09:25  BOOT_TIME
Apr    4    10:00:42  BOOT_TIME
Apr    5    10:09:17  BOOT_TIME
Apr    8    09:47:02  BOOT_TIME
Apr    8    21:21:34  BOOT_TIME
Apr    9    09:34:50  BOOT_TIME
Apr    9    21:16:49  BOOT_TIME

What would be the best way to combine both of these commands to produce output like this:

Month  Day  Time      SystemMessage
Mar    30   12:37:12  BOOT_TIME
Mar    30   02:50:56  SHUTDOWN_TIME

The output from the first command has a ":" at the end of each line,how can these be removed from the output?


-1

Save both the output in 2 files and use below command to achieve result as mentioned

cat file1 file2|sed  '/Month/d'| sed "s/:$//g"| sed '1i Month  Day  Time      SystemMessage'

Month  Day  Time      SystemMessage
Mar    30   02:50:56  SHUTDOWN_TIME
Mar    30   13:13:28  SHUTDOWN_TIME
Apr    1    17:27:48  SHUTDOWN_TIME
Apr    1    23:59:37  SHUTDOWN_TIME
Apr    10   17:08:10  SHUTDOWN_TIME
Apr    10   22:59:13  SHUTDOWN_TIME
Apr    11   19:13:43  SHUTDOWN_TIME
Apr    2    16:33:50  SHUTDOWN_TIME
Apr    3    00:13:58  SHUTDOWN_TIME
Apr    3    16:54:22  SHUTDOWN_TIME
Apr    3    23:36:55  SHUTDOWN_TIME
Apr    4    17:00:40  SHUTDOWN_TIME
Apr    5    17:00:50  SHUTDOWN_TIME
Apr    8    17:41:18  SHUTDOWN_TIME
Apr    8    23:41:05  SHUTDOWN_TIME
Apr    9    17:19:33  SHUTDOWN_TIME
Apr    9    23:23:18  SHUTDOWN_TIME
Mar    30   12:37:12  BOOT_TIME
Apr    1    10:09:12  BOOT_TIME
Apr    1    21:45:41  BOOT_TIME
Apr    10   09:38:12  BOOT_TIME
Apr    10   19:53:06  BOOT_TIME
Apr    11   12:02:02  BOOT_TIME
Apr    12   09:33:21  BOOT_TIME
Apr    2    10:19:19  BOOT_TIME
Apr    2    22:54:34  BOOT_TIME
Apr    3    09:56:02  BOOT_TIME
Apr    3    21:09:25  BOOT_TIME
Apr    4    10:00:42  BOOT_TIME
Apr    5    10:09:17  BOOT_TIME
Apr    8    09:47:02  BOOT_TIME
Apr    8    21:21:34  BOOT_TIME
Apr    9    09:34:50  BOOT_TIME
Apr    9    21:16:49  BOOT_TIME
  • Why would you delete the lines matching Month? Can't you just do that on all lines but the first? That would save you the trouble of inserting that header (yet again). Also, you probably have to sort it again. – Kusalananda Apr 13 at 15:34
2

You would probably do something like the following to combine them (untested as I don't have access to the logs on a macOS High Sierra system, and the log messages don't match at all on my Mojave system):

cat /private/var/log/system.log | awk '
    BEGIN { OFS="\t"; print "Month", "Day", "Time", "Message" }
    /SHUTDOWN_TIME/ { sub(":$","",$8); print $1, $2, $3, $8 }
    /BOOT_TIME/     {                  print $1, $2, $3, $6 }'

The sub() removes the trailing : on the 8th field if it's there.

Note that I'm only printing the header once whereas you print it once for each line. The sorting would also be unnecessary as logfiles are presumably already sorted by time.

On my macOS Mojave system, the other system.log* files are compressed, which means that you can't use cat to send their contents to awk. You would use zcat on these. As the admin user on the system, I also don't have to use sudo to read the logs.

  • This works fine...I added "\t" to the "Message filed which gives perfect output cat /private/var/log/system.log | awk ' BEGIN { OFS="\t"; print "Month", "Day", "Time", "\tMessage" } /SHUTDOWN_TIME/ { sub(":$","",$8); print $1, $2, $3, $8 } /BOOT_TIME/ { print $1, $2, $3, $6 }' – swasti bhushan deb Apr 12 at 12:55
  • @swastibhushandeb It would be better to add a few spaces to the Time field as adding a tab would push the Message header into the "next field" (the 5th field, for which there is no data in the rest of the file). – Kusalananda Apr 12 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.