Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I wrote a script to print 5 days prior to the end of a log file ! and now I want to change it in some way to print 5 hours prior to the end of the file !

this is the script :

for d in \
 $(sed -nre 's/.*\[(..)\/(...)\/(....):(..:..:..) .*/\1 \2 \3 \4/p' thttpd.log | date +%s -f-);
do echo $d >s1; done

time=$(expr 60 \* 60 \* 24 \* 5)
EDATE=`tail -1 s1`
SDATE=$[$EDATE - $time]
sd=`date -d '1970-01-01 UTC '$SDATE' seconds' +"%d/%b/%Y"`
echo $sd
awk -F'[:[]' -v vd=$sd 'BEGIN{ gsub(/\//," ",vd);"date +%s -d \""vd"\""|getline d} {p=$0;  gsub(/\//," ",$2); "date +%s -d \""$2"\""|getline o;if(o>d) print p}' ll.log

example of log file :

213.64.153.92 - - [26/Sep/2002:00:15:15 +0200] "GET/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" ""
213.64.153.92 - - [26/Sep/2002:00:15:16 +0200] "GET/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" ""
share|improve this question
    
Delete *24 from time didn't work? –  quanta Sep 28 '11 at 17:23
    
no :((( it should print from 01/Jan/2003/07:55:21 it seems that awk command in last line did not work here ! –  matarsak Sep 28 '11 at 17:28
add comment

1 Answer

A suggestion, the GNU date command (found on most Linux systems) can take a date expression:

  date --date='today-7 days 0000'   ;; print 7 days earlier than today at 0000

  date --date='26 Sep 2002 00:15:16 -5 hours'  ;; closer to your example

This could make your scripting a little easier.

Thus the processing would be: (1) get start date and format it (2) locate point in file, and (3) print. This can be done in a variety of ways, probably with a simple sed statement on the log file.

EDIT ADDITIION:

Specifically this should work: (not guaranteed to be fully tested but works!)

 #! /bin/sh
 set -uh

 filename=/var/log/apache2/access_log

 lastdate=`tail -1 $filename | sed 's/^.*\[//
 s/\].*$//
 s/ .*$//
 s/\// /g
 s/:/ /'`
 newdate=`date --date="$lastdate -5 hours" +"%d\/%b\/%Y:%H:"`
 awk '/'"$newdate"'/,/^$/    {print $0}' $filename

 exit 0
share|improve this answer
    
SDATE contains the specific time , I run date --date=' $EDATE -5 hours' but faced error date: invalid date ` $EDATE -5 hours' –  matarsak Sep 28 '11 at 17:51
    
I'm very beginner ! I didn't get what you mean :((( could you please write for me the script with sed command and whatever that I should write –  matarsak Sep 28 '11 at 18:02
    
I checked that , but couldn't run it . ./111: line 6: unexpected EOF while looking for matching ``' ./111: line 9: syntax error: unexpected end of file –  matarsak Sep 28 '11 at 19:07
    
Edited and made into a script and successfully run. Again, I cannot guarantee it to be fully tested. –  mdpc Sep 28 '11 at 22:04
    
I checked this , It print the hour from 213.64.56.208 - - [01/Jan/2003:10:14:34 +0100] till 213.46.27.204 - - [01/Jan/2003:12:55:21 +0100] , while it should print from 7:55 till 12:55 –  matarsak Sep 29 '11 at 15:52
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.