1

I need to process my logfile /var/log/mylogs.log. I am only interested in the new entries, lets say, since Jul 20 15:00:00 but the log contains older entries as well.

Is there any simple way, how I could cat only entries older than certain date?

  • Which thing do you want? Your question says your only interested in new entries since date X, but then you're also asking how to cat entries older than a date X. – slm Aug 6 '13 at 11:57
2

You could write a little bash script that uses date to parse the dates:

#!/usr/bin/env bash

## Your date threshold
limit="Jul 20 15:00:00"
## Your limit in seconds since the UNIX epoch
limit_seconds=$(date -d "$limit" +%s)

while read line; do
    ## Extract the date and convert to seconds since epoch for comparison
    date=$(date -d "$(echo "$line" | cut -d ' ' -f -4)" +%s);
    ## Is this newer than the limit? If yes, print the line
    if [ "$date" -ge "$limit_seconds" ]; then
    echo "$line"
    fi

done

Save this script in your path (e.g. /usr/local/bin/parse_log.sh) and you can then run it like this:

parse_log.sh < /var/log/mylogs.log
0

You might be interested to do this with perl:

perl -wlne '/^Jul\ 20\ 15\:00\:00/ .. eof() and print' /path/to/logfile.txt

You might want to adjust the regex to your exact needs.

  • 3
    Please keep in mind, that the exact string "Jul 20 15:00:00" will most likely not be in the logs. The log might look like this: "Jul 20 14:55:12" "Jul 20 15:02:10" – Martin Vegter Aug 6 '13 at 11:20
  • Also, what's the point of .. eof()? You could just say perl -ne '/^Jul\ 20\ 15\:00\:00/ and print' – terdon Aug 6 '13 at 13:45
  • @terdon Just easy to replace with the date where you want to end... But indeed, it's pointless in this case. – Mimor Aug 6 '13 at 14:12
0

This is best done in a language which makes date manipulations easy. I assume that each log line begins with a date in mmm dd HH:MM:SS format and that all log entries are from the current year.

<var/log/mylogs.log perl -MDate::Parse -e '
    $cutoff = str2time($ARGV[0]);
    while (<STDIN>) {
        print if /^(... [ 0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9])/ and
                 str2time($1) <= $cutoff
    }
' 'Jul 20 15:00:00'

This snippet prints all lines with older dates. If you want the newer entries, reverse the comparison (str2time($1) >= $cutoff). When printing older entries, you can save a bit of processing by bailing out as soon as a too-late entry is reached.

<var/log/mylogs.log perl -MDate::Parse -e '
    $cutoff = str2time($ARGV[0]);
    while (<STDIN>) {
        exit if /^(... [ 0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9])/ and
             str2time($1) > $cutoff;
        print;
    }
' 'Jul 20 15:00:00'
0

Looking for same answer I found this old topic

And I solved it by using grep with -B option:

cat /var/log/mylogs.log | grep -B 1000 "Jul 20 15:00:00"

It will show line with that date and 1000 lines before it. Simple and easy. You just need to be sure that you are greping date that exist in your log file. Same way with -A option you can search for newer entries.

-1

Try sed aswell:

sed -n '/^Jul\ 20\ 15\:00\:00/,/eof()/p' /path/to/logfile.txt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.