Collect last 2 days data from /var/log/messages

Shell Programming and Scripting
1

I need to collect last 2 days data from /var/log/messages into a separate file (file format: flmessagetimedaymonth). I have collect today's month, date, time information in separate variable. Please help me in this issue (Probably need awk and grep function).

month=$(date|awk '{print $2}')
day=$(date|awk '{print $3}')
time=$(date|awk '{print $4}')

#nday=$((day-1))

echo $month $day $time

i=2

#for i in 2 1 0

Sample of /var/log/messages

Apr 12 12:02:35 RH6 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Apr  12 12:02:35 RH6 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2"  x-pid="1261" x-info="http://www.rsyslog.com"] (re)start
Apr 14 19:14:55 RH6 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Apr 14 19:14:55 RH6 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1261" x-info="http://www.rsyslog.com"] (re)start
2 
find . ! -name -prune -type f -mtime -2

This will give all files of last 2 days

3

I don't need last 2 days files.....actually i need last 2 days information from /var/log/messages

Sample Input of /var/log/messages

Apr 11 9:05:35 RH6 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Apr 11 9:05:35 RH6 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1261" x-info="http://www.rsyslog.com"] (re)start
Apr 13 12:02:35 RH6 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Apr 13 12:02:35 RH6 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1261" x-info="http://www.rsyslog.com"] (re)start
Apr 14 19:14:55 RH6 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Apr 14 19:14:55 RH6 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1261" x-info="http://www.rsyslog.com"] (re)start

Sample Output for given input

Apr 13 12:02:35 RH6 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Apr 13 12:02:35 RH6 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1261" x-info="http://www.rsyslog.com"] (re)start
Apr 14 19:14:55 RH6 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Apr 14 19:14:55 RH6 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1261" x-info="http://www.rsyslog.com"] (re)start

4 
egrep "^$(date -d '2 days ago' '+%h %d')|^$(date -d 'yesterday' '+%h %d')|^$(date '+%h %d')" /var/log/messages

---------- Post updated at 02:44 PM ---------- Previous update was at 02:35 PM ----------

This is an awk code for the same

awk -vp="^$(date -d '2 days ago' '+%h %d')" -vy="^$(date -d 'yesterday' '+%h %d')" -vt="^$(date '+%h %d')" '{if($0 ~ p || $0 ~ y || $0 ~ t) print}' /var/log/messages
5

The problem you have is at the first of the month. (day - 2) does not work when today is the 1st or 2nd. The command "date '2 days ago'" does not work with the standard Unix date command. That syntax is a part of the GNU version of date. I would recommend installing it as it seems to be 100% backwards compatible with the vanilla date command but, as you can see, adds much more functionality. It is a part of the coreutils package from GNU. Once you have this then SriniShoo's examples should work. I like to install this and call it gdate just to make sure to keep the original date command in tact.

There is also a shell script you can find on this site written by Perderabo which also does some pretty good date handling called datecalc. I like the GNU date a little better but, just in case you cannot install 3rd party software, datecalc is a pretty close second.