Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm working with a log file and I want to print from a specific day till the end of it . that specific date is ($sd=27/Dec/2002) for example. now I want to search for this day and print from it till the end of log file ! but what if 27/Dec is not among items in log file ? it should search for items >= $sd (27/Dec) , how could I do this?

this code just search for $Sd which is 27/Dec/2002 , I want to search for items >= $sd

sed -n "$(awk '/'$sd'/ {print NR}' serverlog.log.log | head -1),$ p" serveerlog.log|cut -d: -f1

solved !

awk -F'[:[]' -v vd=$sd 'BEGIN{ gsub(///," ",vd);"date +%s -d \""vd"\""|getline d} {p=$0; gsub(///," ",$2); "date +%s -d \""$2"\""|getline o;if(o>d) print p}' ll.log|cut -d: -$

share|improve this question
    
no ! its' totally sth else ! –  matarsak Sep 28 '11 at 15:12
    
serverfault.com/questions/296555/… –  quanta Sep 28 '11 at 15:19
    
I already looked at this link but I don't understand . why you just repeat these things over and over ? If I've already understand what to do, I wouldn't have asking again ! I'm beginner ! –  matarsak Sep 28 '11 at 15:24
add comment

2 Answers

If what you need is print the lines after the first occurence of a date, try this :

tail --lines=\+`cat your_file | grep -n "27/Dec/2002" | awk -F : '{ print $1 }'` your_file 
share|improve this answer
    
I checked it , but faced with error ! tail: +: invalid number of lines –  matarsak Sep 28 '11 at 16:02
    
@matarsak : could you launch only the cat ... part and display the result ? –  Cédric Julien Sep 28 '11 at 16:06
    
it prints from 31 march 2002 which is the first item in log file till the end ! –  matarsak Sep 28 '11 at 16:10
    
I mean the cat...|grep...|awk part –  Cédric Julien Sep 28 '11 at 16:47
    
thanks this part solved ! –  matarsak Sep 28 '11 at 16:49
add comment
#!/bin/bash

sd=27/Sep/2011

from=$(date -d "$(echo "$sd" | awk 'BEGIN { FS = "/"; } { print $1" "$2" "$3" 00:00:00" }')" +%s)

while read line
do
    date=$(echo $line | awk '{ print substr($4, 2, length($4)-1) }' | awk 'BEGIN { FS = "[/:]"; } { print $1" "$2" "$3" "$4":"$5":"$6 }')
    dateepoch=$(date -d "$date" +%s)
    if [ $dateepoch -ge $from ]; then
        line_number=$(grep -n $(echo $line | awk '{ print substr($4, 2, length($4)-1) }') -m 1 input | cut -d: -f1)
        break
    fi
done < input

awk 'NR >= '$line_number'' input

The input file:

127.0.0.1 - - [18/Sep/2011:21:57:28 +0700] "GET /favicon.ico HTTP/1.1" 404 268
127.0.0.1 - - [19/Sep/2011:22:07:52 +0700] "GET /abcde.png HTTP/1.1" 404 277
127.0.0.1 - - [20/Sep/2011:22:07:54 +0700] "GET /abcde.png HTTP/1.1" 404 277
127.0.0.1 - - [21/Sep/2011:22:11:05 +0700] "GET /index HTTP/1.1" 502 462
127.0.0.1 - - [22/Sep/2011:22:31:22 +0700] "GET / HTTP/1.1" 502 462
127.0.0.1 - - [23/Sep/2011:10:17:34 +0700] "GET / HTTP/1.1" 502 471
127.0.0.1 - - [24/Sep/2011:10:17:36 +0700] "GET /favicon.ico HTTP/1.1" 404 277
127.0.0.1 - - [25/Sep/2011:10:17:36 +0700] "GET /favicon.ico HTTP/1.1" 404 277
127.0.0.1 - - [26/Sep/2011:11:10:33 +0700] "GET / HTTP/1.1" 502 469
127.0.0.1 - - [27/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275
127.0.0.1 - - [28/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275

The result:

$ ./date.sh 
127.0.0.1 - - [27/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275
127.0.0.1 - - [28/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275

If you change sd to 17/Sep/2011:

$ ./date.sh 
127.0.0.1 - - [18/Sep/2011:21:57:28 +0700] "GET /favicon.ico HTTP/1.1" 404 268
127.0.0.1 - - [19/Sep/2011:22:07:52 +0700] "GET /abcde.png HTTP/1.1" 404 277
127.0.0.1 - - [20/Sep/2011:22:07:54 +0700] "GET /abcde.png HTTP/1.1" 404 277
127.0.0.1 - - [21/Sep/2011:22:11:05 +0700] "GET /index HTTP/1.1" 502 462
127.0.0.1 - - [22/Sep/2011:22:31:22 +0700] "GET / HTTP/1.1" 502 462
127.0.0.1 - - [23/Sep/2011:10:17:34 +0700] "GET / HTTP/1.1" 502 471
127.0.0.1 - - [24/Sep/2011:10:17:36 +0700] "GET /favicon.ico HTTP/1.1" 404 277
127.0.0.1 - - [25/Sep/2011:10:17:36 +0700] "GET /favicon.ico HTTP/1.1" 404 277
127.0.0.1 - - [26/Sep/2011:11:10:33 +0700] "GET / HTTP/1.1" 502 469
127.0.0.1 - - [27/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275
127.0.0.1 - - [28/Sep/2011:11:10:34 +0700] "GET /favicon.ico HTTP/1.1" 404 275
share|improve this answer
    
could you change while loop ? log file has 14000 lines ! it takes many hours to test this, and someone suggest another code awk -F'[:[]' -v d=$sd '$2>d' serverlog.log , it works with small log file but i don't know why it does not work with my log file ! see stackoverflow.com/questions/7585501/… –  matarsak Sep 28 '11 at 15:57
    
date: invalid date ` ::' –  matarsak Sep 28 '11 at 16:21
    
Check out my updated answer. The while loop will quit after the first line has date is greater than $sd was found. –  quanta Sep 28 '11 at 16:25
    
Edit your post and append a few lines from your server log. –  quanta Sep 28 '11 at 16:26
    
that problem solved and finally I could print the last 5 days ! now how could I generalize this ? so that user enter a number and the program do the same ? I usually run these kind of script this way 1.sh D 10 ( means run file 1.sh for 10 days !! ) –  matarsak Sep 28 '11 at 16:48
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.