tail -n 100 myfile.log

gives my the last 100 lines of myfile.log.

Is there an existing tool that expects the first "column" of each line in a file as a timestamp and can give me the n last hours/days/...?

We can assume the lines in the file have ascending timestamps.


tailtm -h 10 myfile.log

The tool should accept most common timestamp-formats of Linux logfiles.

  • Is sorting (from the title) important? – Jeff Schaller Nov 12 '19 at 18:44
  • 1
    stdout of systemd services is redirected to journald. If it's your case you can just use journalctl -u abc.service --since=XXX – mrc02_kr Nov 12 '19 at 21:11
  • This is a nice way! But can I use it to find PAM-entries too? – chris01 Nov 12 '19 at 21:25

As mentioned in the comments it is working with journalctl.


journalctl -u sshd.service --since "2019-11-01 12:00:00"

I generate the sinde-timestamp for each call so I can have the timerange back as I need.

Thanks to mrc02_kr!

  • Please edit this so it looks like an answer to the question.  It’s OK to repeat information provided by somebody else if you give credit to the original author. – G-Man Says 'Reinstate Monica' Nov 13 '19 at 2:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.