Narrow down a log the log file for certain period

Shell Programming and Scripting
1

Dear friends,

Please help me out to narrow down a log file with the time range. The log file will be in the following format,

213.64.141.89 - - [26/Oct/2002:18:55:21 +0200]
213.64.248.179 - - [26/Oct/2002:21:02:19 +0200]
213.64.248.179 - - [26/Oct/2002:21:02:23 +0200]

What are shell commands to narrow the file for certain hours or days. I think this can be done with the date arithmetic. If I am right, please let me know how can do arithmetic in date values.

Thank in advance,
Tamil Pamaran

2

Your requirement is not very clear.

For what I understood, a simple "grep" would produce the desired output.

To display a specific day:

grep '26/Oct/2002' File

To display a specific hour (7) in a day (26/Oct/2002):

grep '26/Oct/2002:07' File

Is this what you are looking for?

3

Thanks for your response,

Basically I am looking for a mechanism to extract the log that fall under a time range.

start time
-----
-----
-----
End time

Date format is given in my first post.

Thank You

4

You need nawk or gawk, not plain awk.

nawk -v SDATE="26/Oct/2002:18:55:21" -v EDATE="26/Oct/2002:21:02:19" 'BEGIN {
        # Set up arrays for name-to-monthnumber
        split("Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec", MON, "|");
        for(N=1; N<=12; N++) MNUM[MON[N]]=N;

        split(SDATE, D, "[:/]");
        # Convert "YYYY MM DD HH MM SS" into epoch time
        SDATE=mktime(D[3] " " MNUM[D[2]] " " D[1] " " D[4] " " D[5] " " D[6]);
        split(EDATE, D, "[:/]");
        EDATE=mktime(D[3] " " MNUM[D[2]] " " D[1] " " D[4] " " D[5] " " D[6]);
}

{       if(NF > 1)
        {
                split($(NF-1), D, "[\\[:/]");
                DATE=mktime(D[4] " " MNUM[D[3]] " " D[2] " " D[5] " " D[6] " " D[7]);

                if((DATE >= SDATE) && (DATE <= EDATE)) print;
        } }' < datafile
5

All the nawks that I know don't have the mktime built-in function. But Corona688's solution works without mktime (just omit mktime and the surrounding parentheses) since the date values are in "yyyy mm dd hh mi ss" format which can be compared natively (you can omit all the spaces). mktime is needed if you want to compare two dates to see e.g. if they are within 10 seconds.

With a little modification:

for(N=1; N<=12; N++) MNUM[MON[N]]=sprintf("%02d", N);

Note, to compare the dates, all you need to do is arrange the values in year, month, day, hour, minute, second format. The "/"s and the ":"s don't matter as long as the digits are all the same widths and months are in numeric formats.

6

Natively, as in, alphabetically? Clever. :slight_smile: