0

I'm working with a log file and I want to print from a specific day till the end of it . that specific date is ($sd=27/Dec/2002) for example. now I want to search for this day and print from it till the end of log file ! but what if 27/Dec is not among items in log file ? it should search for items >= $sd (27/Dec) , how could I do this?

this code just search for $Sd which is 27/Dec/2002 , I want to search for items >= $sd

sed -n "$(awk '/'$sd'/ {print NR}' serverlog.log.log | head -1),$ p" serveerlog.log|cut -d: -f1

solved !

awk -F'[:[]' -v vd=$sd 'BEGIN{ gsub(///," ",vd);"date +%s -d \""vd"\""|getline d} {p=$0; gsub(///," ",$2); "date +%s -d \""$2"\""|getline o;if(o>d) print p}' ll.log|cut -d: -$

3
  • no ! its' totally sth else !
    – matarsak
    Sep 28, 2011 at 15:12
  • serverfault.com/questions/296555/…
    – quanta
    Sep 28, 2011 at 15:19
  • I already looked at this link but I don't understand . why you just repeat these things over and over ? If I've already understand what to do, I wouldn't have asking again ! I'm beginner !
    – matarsak
    Sep 28, 2011 at 15:24

2 Answers 2

0

If what you need is print the lines after the first occurence of a date, try this :

tail --lines=\+`cat your_file | grep -n "27/Dec/2002" | awk -F : '{ print $1 }'` your_file 
4
  • I checked it , but faced with error ! tail: +: invalid number of lines
    – matarsak
    Sep 28, 2011 at 16:02
  • @matarsak : could you launch only the cat ... part and display the result ? Sep 28, 2011 at 16:06
  • it prints from 31 march 2002 which is the first item in log file till the end !
    – matarsak
    Sep 28, 2011 at 16:10
  • I mean the cat...|grep...|awk part Sep 28, 2011 at 16:47
0
#!/bin/bash

sd=27/Sep/2011

from=$(date -d "$(echo "$sd" | awk 'BEGIN { FS = "/"; } { print $1" "$2" "$3" 00:00:00" }')" +%s)

while read line
do
    date=$(echo $line | awk '{ print substr($4, 2, length($4)-1) }' | awk 'BEGIN { FS = "[/:]"; } { print $1" "$2" "$3" "$4":"$5":"$6 }')
    dateepoch=$(date -d "$date" +%s)
    if [ $dateepoch -ge $from ]; then
        line_number=$(grep -n $(echo $line | awk '{ print substr($4, 2, length($4)-1) }') -m 1 input | cut -d: -f1)
        break
    fi
done < input

awk 'NR >= '$line_number'' input

The input file:

127.0.0.1 - - [18/Sep/2011:21:57:28 +0700] "GET /favicon.ico HTTP/1.1" 404 268
127.0.0.1 - - [19/Sep/2011:22:07:52 +0700] "GET /abcde.png HTTP/1.1" 404 277
127.0.0.1 - - [20/Sep/2011:22:07:54 +0700] "GET /abcde.png HTTP/1.1" 404 277
127.0.0.1 - - [21/Sep/2011:22:11:05 +0700] "GET /index HTTP/1.1" 502 462
127.0.0.1 - - [22/Sep/2011:22:31:22 +0700] "GET / HTTP/1.1" 502 462
127.0.0.1 - - [23/Sep/2011:10:17:34 +0700] "GET / HTTP/1.1" 502 471
127.0.0.1 - - [24/Sep/2011:10:17:36 +0700] "GET /favicon.ico HTTP/1.1" 404 277
127.0.0.1 - - [25/Sep/2011:10:17:36 +0700] "GET /favicon.ico HTTP/1.1" 404 277
127.0.0.1 - - [26/Sep/2011:11:10:33 +0700] "GET / HTTP/1.1" 502 469
127.0.0.1 - - [27/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275
127.0.0.1 - - [28/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275

The result:

$ ./date.sh 
127.0.0.1 - - [27/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275
127.0.0.1 - - [28/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275

If you change sd to 17/Sep/2011:

$ ./date.sh 
127.0.0.1 - - [18/Sep/2011:21:57:28 +0700] "GET /favicon.ico HTTP/1.1" 404 268
127.0.0.1 - - [19/Sep/2011:22:07:52 +0700] "GET /abcde.png HTTP/1.1" 404 277
127.0.0.1 - - [20/Sep/2011:22:07:54 +0700] "GET /abcde.png HTTP/1.1" 404 277
127.0.0.1 - - [21/Sep/2011:22:11:05 +0700] "GET /index HTTP/1.1" 502 462
127.0.0.1 - - [22/Sep/2011:22:31:22 +0700] "GET / HTTP/1.1" 502 462
127.0.0.1 - - [23/Sep/2011:10:17:34 +0700] "GET / HTTP/1.1" 502 471
127.0.0.1 - - [24/Sep/2011:10:17:36 +0700] "GET /favicon.ico HTTP/1.1" 404 277
127.0.0.1 - - [25/Sep/2011:10:17:36 +0700] "GET /favicon.ico HTTP/1.1" 404 277
127.0.0.1 - - [26/Sep/2011:11:10:33 +0700] "GET / HTTP/1.1" 502 469
127.0.0.1 - - [27/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275
127.0.0.1 - - [28/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275
7
  • could you change while loop ? log file has 14000 lines ! it takes many hours to test this, and someone suggest another code awk -F'[:[]' -v d=$sd '$2>d' serverlog.log , it works with small log file but i don't know why it does not work with my log file ! see stackoverflow.com/questions/7585501/…
    – matarsak
    Sep 28, 2011 at 15:57
  • date: invalid date ` ::'
    – matarsak
    Sep 28, 2011 at 16:21
  • Check out my updated answer. The while loop will quit after the first line has date is greater than $sd was found.
    – quanta
    Sep 28, 2011 at 16:25
  • Edit your post and append a few lines from your server log.
    – quanta
    Sep 28, 2011 at 16:26
  • that problem solved and finally I could print the last 5 days ! now how could I generalize this ? so that user enter a number and the program do the same ? I usually run these kind of script this way 1.sh D 10 ( means run file 1.sh for 10 days !! )
    – matarsak
    Sep 28, 2011 at 16:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .