Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to find out what was added to a log file between 2 tasks. Right now the way I do it is:

content of test.log initially


saving content of the log

$ cp test.log test.log.before

doing something

content of test.log after doing something


saving content of the log

$ cp test.log test.log.after

showing the difference

$ diff test.log.before test.log.after
> ccc

What I don't like with this method is that I get some noise from diff (2a3 and >) whereas I just want ccc.

Q: Is there a way I can just get the difference between the 2 log files (i.e. what is new in test.log.after, ccc)?

I had a look at diff's man page but I don't see anything obvious there.

share|improve this question
up vote 3 down vote accepted

If you want to get the additions only you can filter the output such as:

$ diff test.log.before test.log.after | grep "^>" | cut -c 3-

However, you will lose the deletions if any.

share|improve this answer

If you always do a before and after such that the end of the after file will contain the new content then you could use comm.

$ cat before 

$ cat after

$ comm -3  after before
share|improve this answer
But, the files should be sorted! – Khaled Nov 29 '11 at 12:17
This works as expected if the files are the same up to the point that new stuff is added. – Iain Nov 29 '11 at 12:36
comm is OK but output comes out tabulated. I prefer the grep+cut alternative. – Max Nov 29 '11 at 12:44
that's why I did after before so that the output (which contains the changes) is at the beginning of the line, doing before after would give you tabs to deal with. – Iain Nov 29 '11 at 12:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.