up vote 3 down vote favorite
1
share [g+] share [fb]

I have a 3GB log file, I need to extract the past 48 hours without downloading the entire 3GB file. How can I split the file up into the past 48 hours. So I can only download that single file?

I have full SSH access and I'm able to install additional tools.

link|improve this question
88% accept rate
1  
what access do you have on the server ? Does it have to be now() - 48hrs or wiin from midnight yesterday do ? – Iain♦ Sep 29 '11 at 14:52
I have full access, it needs to be from now() - 48hrs – Tom Sep 29 '11 at 14:58
feedback

2 Answers

up vote 8 down vote accepted

Assuming you have shell access to the server with the log file, try

egrep '2[789]/Sep/2011' logfile.big > /tmp/logfile.small

That will go back to the beginning of the 27th, which is a little over 48 hours, but I would expect that to be much smaller than the whole file, and it's quick to do. Don't forget to gzip the resulting file before you transfer it, that will speed things up even more.

link|improve this answer
That is awesome, thanks! – Tom Sep 29 '11 at 15:09
feedback
up vote 2 down vote

You can make use of the Apache log parser - Analog. It works quickly because written in C. Analog allows specifying the time ranges with the command line options +F and +T which logically stand for 'FROM' and 'TO'.

link|improve this answer
MatHatter's grep is slick, but +1 for the general case suggestion too. I would have confused Analog with webalizer – iPaulo Sep 29 '11 at 15:52
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.