LinuxQuestions.org - Checking Log Entries for Specific Time Duration

- Programming (https://www.linuxquestions.org/questions/programming-9/)

- - Checking Log Entries for Specific Time Duration (https://www.linuxquestions.org/questions/programming-9/checking-log-entries-for-specific-time-duration-926846/)

Checking Log Entries for Specific Time Duration

Hi Shell Script Gurus!

I have a log file. Each line starts with a date/time-stamp such as:

Code:

[30 Jan 2012 22:10:15,22] blah! blah

[30 Jan 2012 22:50:55,20] blah! blah

[30 Jan 2012 23:00:15,20] blah! blah

...

...

[31 Jan 2012 01:10:51,332] blah! blah

...

...

...

Let us specify date and Hours value only as our search criterion:

Code:

$ echo $ago

30 Jan 2012 22

Well, the following code would work, provided that it does find the date and the exact hour values at least once to start from and then would print out rest of the log entries (till now/current time):

Code:

$ cat data.log | awk -v whence="$ago" '{if($0 ~ whence){found=1;}if(found==1){print $0}}'

Suppose, the log file does not have an entry for the hours 22:xx:xx then the code would skip the newer entries as well.

What I want is if Hours 22 if not there but still it should check for newer entries, such as these ones:

Code:

[30 Jan 2012 23:00:15,20] blah! blah

...

...

[31 Jan 2012 01:10:51,332] blah! blah

The variable "ago" is assigned a value as shown below:

Code:

ago=`date "+%d %b %Y %H" -d "$1 hours ago"`

So that we can say:

Code:

script.sh 4

to mean search for log entries starting from 4 hours ago and on-wards / till the EOF.

Note: We are no interested in the Minutes:Seconds fields. Only Hours is important for a given date/time.

The above "date" command is very helpful if 4 hours ago it was yesterday's date. But if the Hours value is exactly not matched then the newer entries are skipped which is something undesirable (the "awk" command as given above).

Well, something similar to this scenario I have done before using "awk" but my head is not able to recall how.:scratch:

Quote:

`date "+%Y %m %m %H" -d "$1 hours ago"`

and you would have to match this against the result of

$3 plus $2 transformed into 01, 02 .. 12 from Jan, Feb .. Dec plus $1 plus left($3,2).

I leave it to you work it out.

OK

Quote:

Originally Posted by AnanthaP (Post 4590152)

In awk, the selection criterion would become > the $ago value and you wouldn't need the found flag.

But be careful. As you define the problem, feb 01 (today) wouldn't select correctly.

So maybe you change "ago" to contain and you would have to match this against the result of

$3 plus $2 transformed into 01, 02 .. 12 from Jan, Feb .. Dec plus $1 plus left($3,2).

I leave it to you work it out.

OK

Well, I did not get your solution even though I read it twice or thrice.

If the date part would not be a problem then I would simply compare the Hours field and get the work done as I have done before. But in the present scenario the Date part is important when it changes from yesterday's to today's.