0

I would like to monitor the /var/log/secure file for user activity. I need to be able to provide a start date and select lines only occurring after that date . I have played around with awk for a while and have not been able to find a solution that works. I have had some commands that appear to work but just end up selecting every line from the file. In the command below I am trying to select all entries after July 9th, 2019.

cat /var/log/secure* | awk '{d=system("date -d "$1 $2, 2019 $3" +%s"); if ( 1562731201 < d );  print}'
awk: cmd. line:1: {d=system("date -d "$1 $2, 2019 $3" +%s"); if ( 1562731201 > d );  print}
awk: cmd. line:1:                                         ^ 2 is invalid as number of arguments for system

date -d @1562644801
Tue Jul  9 00:00:01 EDT 2019

Any help you can provide would be appreciated.

1
  • If you use GNU awk, then use its builtin mktime() function instead of calling out to date for every line. Should be a lot faster, but you make have to do a little more work to build the string argument for mktime. Jul 11, 2019 at 14:37

2 Answers 2

0

I believe Below command may work, As tested it worked fine for me

sed -n '/Jul 9 [0-9]\{2\}:/,$p' /var/log/secure| sed '/Jul 9 [0-9]\{2\}:/d'
2
  • Sorry for the delay in my response Praveen, I appreciate your answer. If you are willing and have time can you please explain what this command is actually doing?
    – PaulL
    Jul 23, 2019 at 20:17
  • It will select all lines after July 9 2019 till last line tested and worked too Jul 23, 2019 at 23:39
0

You need to escape the inner quotation marks.

"date -d \"$1 $2, 2019 $3\" +%s"

So turn it into

'{d=system("date -d \"$1 $2, 2019 $3\" +%s"); if ( 1562731201 < d );  print}'
7
  • Thanks for the quick reply Panki. looks like the date command is not accepting the parameters passed to it and it is printing entries before July 9. date: invalid date ‘ , 2019 ’ Jul 8 01:44:32 server1 sshd[34408]: pam_unix(sshd:session): session opened for user root by (uid=0)
    – PaulL
    Jul 11, 2019 at 14:33
  • Assuming $1,$2,$3 are awk fields, they can't be inside a quoted string: cmd=sprintf("date -d \"%s %s, 2019 %s\" +%%s", $1, $2, $3), d = system(cmd) Jul 11, 2019 at 14:33
  • @glennjackman Post this as an answer if it ends up working for OP
    – Panki
    Jul 11, 2019 at 14:36
  • Feel free to put it in your answer. Jul 11, 2019 at 14:38
  • cat /var/log/secure* | awk '{cmd=sprintf("date -d \"%s %s, 2019 %s\" +%%s", $1, $2, $3), d = system(cmd); if ( 1562731201 < d ); print}' gives a syntax error on this comma before the d "......$3), d = system(cmd)....." if I change it to a semicolon it selects entries before July 9th.
    – PaulL
    Jul 11, 2019 at 14:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .