print from a specific time in a log time

Question

I wrote a script to print 5 days prior to the end of a log file ! and now I want to change it in some way to print 5 hours prior to the end of the file !

this is the script :

for d in \
 $(sed -nre 's/.*\[(..)\/(...)\/(....):(..:..:..) .*/\1 \2 \3 \4/p' thttpd.log | date +%s -f-);
do echo $d >s1; done

time=$(expr 60 \* 60 \* 24 \* 5)
EDATE=`tail -1 s1`
SDATE=$[$EDATE - $time]
sd=`date -d '1970-01-01 UTC '$SDATE' seconds' +"%d/%b/%Y"`
echo $sd
awk -F'[:[]' -v vd=$sd 'BEGIN{ gsub(/\//," ",vd);"date +%s -d \""vd"\""|getline d} {p=$0;  gsub(/\//," ",$2); "date +%s -d \""$2"\""|getline o;if(o>d) print p}' ll.log

example of log file :

213.64.153.92 - - [26/Sep/2002:00:15:15 +0200] "GET/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" ""
213.64.153.92 - - [26/Sep/2002:00:15:16 +0200] "GET/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" ""

Answer 1

A suggestion, the GNU date command (found on most Linux systems) can take a date expression:

  date --date='today-7 days 0000'   ;; print 7 days earlier than today at 0000

  date --date='26 Sep 2002 00:15:16 -5 hours'  ;; closer to your example

This could make your scripting a little easier.

Thus the processing would be: (1) get start date and format it (2) locate point in file, and (3) print. This can be done in a variety of ways, probably with a simple sed statement on the log file.

EDIT ADDITIION:

Specifically this should work: (not guaranteed to be fully tested but works!)

 #! /bin/sh
 set -uh

 filename=/var/log/apache2/access_log

 lastdate=`tail -1 $filename | sed 's/^.*\[//
 s/\].*$//
 s/ .*$//
 s/\// /g
 s/:/ /'`
 newdate=`date --date="$lastdate -5 hours" +"%d\/%b\/%Y:%H:"`
 awk '/'"$newdate"'/,/^$/    {print $0}' $filename

 exit 0