script that extracts last 7 days of a log file
 

Hello all. I'm new to scripting and wondered if I could get a little help. I would like to execute a script that will extract or display the past 7 days of a log file. The log file is /var/log/messages and below is an example of the date format:

May 11 06:01:40 hostname rtvscand: New virus definition file loaded. Version: 130510c.
May 11 06:01:40 hostname rtvscand: Download of virus definition file from LiveUpdate server succeeded.
May 12 06:01:27 hostname rtvscand: New virus definition file loaded. Version: 130511b.
May 12 06:01:27 hostname rtvscand: Download of virus definition file from LiveUpdate server succeeded.

A friend wrote a script but it is not pulling the last 7 days (please see below)

#!/bin/bash

FILE=/var/log/messages

# Get the julian time for this second
N=`date '+%s'`

# Test: March 1st
#N=`date -j 03010000 '+%s'`

# Create a regular expression to match the last 3 days
REGEXP=""
for I in 1 2 3
do
if [ ! -z "$REGEXP" ]; then
REGEXP="$REGEXP|"
fi

# Get the Month/Day for time N
DAY=`date -r $N '+%b %e'`
REGEXP="${REGEXP}${DAY}"

# Subtract one day
N=`expr $N - 86400`
done

# If today were the 10th of March,
# REGEXP should be "(Mar 10|Mar 9|Mar 8)"
grep -E "^($REGEXP)" $FILE
exit 0

Please help, thanks Johnny Mac

Log extraction
 

here ya go

hope this helps

Do use 'grep' on its own here (also search for "the useless use of cat award"), maybe "anchor" grep search terms with "^"? and finally output will be appended to a file stored in the CWD which may cause unexpected results if the file enlarges beyond capacity of the CWD.

My take on things (easily modified to add days):

Thank you for this prestigious award, and on my very first post, what an honor

The UUOC award has been and can be given to anyone by anyone regardless of time, place or skill.

Iz3k34l
 

After running your script I get a file that is blank. I ensured that a it ended with .sh and chmod the file to 770. I exectuted it as root. If you run the file do you get the last 7 days of \var\log\messages?

Iz3k34l
 

Again, not nothing about scripting. I simply ran your orgianl posting and observed the file created with today's date and there is no data in the file. Below your original posting comments were made but I'm not sure what to make of them or how to utilizing them to edit the script.

Sorry for the confusion. Still don't have a solution.

Johnny Mac

Yes i do,
-rw-r--r-- 1 root root 2616701 Jul 1 09:52 2013-07-01.txt

your permissions should should look like this
-rwxr-xr-x 1 root root 912 Jun 28 11:29 weeklog.sh*

use the "chmod +x weeklog.sh" command

next make sure if you have changed the directory path that you use the correct path '/' not '\'.

try this "tail -f /var/log/messages" to make sure you have data that is seven days old

Fixed - Whew! Resolved
 

The problem the orginal script is that the date command does not interpet like BSD. The foundation of the script was based on the date command. Below is a perl script that works in linux and provides the current date and 8 previous days.

#!/usr/bin/perl

use POSIX;

my $log = "/tmp/messages"; # Log file name
my $n = 8; # Number of days to go back

# Get the julian time for this second
my $jultm = time();

# Test: March 10th, 2000 @ midnight
#$jultm = POSIX::mktime(0, 0, 0, 10, 3, 100);

# Create a regular expression to match the last 3 days
my $regexp = "";
for(my $I = $n; $I > 0; $I--)
{
if (length($regexp) > 0)
{
$regexp .= "|";
}

# Get the Month/Day for time N
my $day = POSIX::strftime("+%b %e", localtime($jultm));
$regexp .= $day;

# Subtract one day
$jultm -= 86400;
}

# If today were the 10th of March,
# regexp should be "(Mar 10|Mar 9|Mar 8)"
#print "REGEXP: $regexp\n";
my $cmd = "grep -E '^($regexp)' $log";
#print "CMD: $cmd\n";
system $cmd;
exit 0;

1) Please use ***[code][/code]*** tags around your code and data, to preserve the original formatting and to improve readability. Do not use quote tags, bolding, colors, "start/end" lines, or other creative techniques. Thanks.

2) Since this is Linux Questions, we usually assume you're using Linux and its tools (i.e. the gnu coreutils) unless otherwise specified. So always clearly specify what your environment is if it's in any way non-standard.

3) I'd have probably suggested awk myself before learning about #2, since gawk has a good set of built-in time functions for this kind of thing. It could probably still be done with nawk or posix awk, but it would be more complex.

4) I'm starting to wonder if I shouldn't institute a ${Useless} ${Use} ${Of} ${Variable} ${Brackets} award, since I've been seeing them so often recently. ;)