code:
grep -rI --exclude=*_*.log -B20 -A1 "Status: Error" > /var/log/alertError.log
Input log example:
[06/07/20 20:38:53.911]:loopback ST: token-src-name()
[06/07/20 20:38:53.914]:loopback ST: Token Value: "DVADER".
[06/07/20 20:38:53.916]:loopback ST: token-text(",OU=users,O=data")
[06/07/20 20:38:53.919]:loopback ST: Arg Value: "CN=DVADER,OU=users,O=data".
[06/07/20 20:38:53.922]:loopback ST: description("Removed by Termination Process")
[06/07/20 20:38:53.926]:loopback ST: token-text("Removed by Termination Process")
[06/07/20 20:38:53.929]:loopback ST: Arg Value: "Removed by Termination Process".
[06/07/20 20:38:53.943]:loopback ST: DirXML Log Event -------------------
Driver: \StarWars\system\Driver Set\User Processor
Channel: Subscriber
Status: Error
Message: Code(-9217) Error in
This input log shows a section of the log I want to grab. However I want to match on the date for the days I want to search the log. I am using grep as I can do a recursive search of all log files in a structure. My grep returns all of the data I want, except I now want to exclude chunks of code that is older. So the date is not on all lines. The grep is returning a chunk of code with the switches B and A that I need. So if you saw the entire line, the message and status lines are consistent with multiple operations going on. I could grab all types of Message or status values with this grep command, but I just don't know how to then eliminate all of the results to only those chunks of code that are for a given date range.
log example
your sample input? If so please edit your question to show the expected output given that input. Usefind
to find files andgrep
to g/re/p files to keep your life and code simple, i.e. don't usegrep
to find files. There is a big clue in the name of each tool what it's supposed to be used for! In this case though it's extremely unlikely thatgrep
will be adequate since you're not trying to just dog/re/p
, you'll probably needawk
or similar.