How to grep logs for errors and receive specific additional lines?

Hi there,

I have a script that I've used to find errors in my Minecraft Server logs. But I'd like to refine that script to be more useful.

Here is the script:

grep -n "SEVERE" /minecraft/server.log | awk -F":" '{print $1-2 "," $1+10 "p"}' | xargs -t -i sed -n {} /minecraft/server.log  >> /minecraft/severe_errors.log

Here is what the script is looking through:

2013-09-20 09:55:28 [INFO] [PermissionsEx] Enabling PermissionsEx v1.19.5
2013-09-20 09:55:28 [INFO] [PermissionsEx] Superperms support enabled.
2013-09-20 09:55:28 [INFO] [PermissionsEx] v1.19.5 enabled
2013-09-20 09:55:28 [INFO] WEPIF: PermissionsEx detected! Using PermissionsEx for permissions.
2013-09-20 09:55:28 [INFO] [Vault][Chat] PermissionsEx_Chat hooked.
2013-09-20 09:55:28 [INFO] [Wither] Enabling Wither v2.0
2013-09-20 09:55:28 [INFO] [Wither] Wither v2.0 enabled!
2013-09-20 09:55:28 [INFO] [MobCatcher] Enabling MobCatcher v3.7
2013-09-20 09:55:28 [INFO] [MobCatcher] Author: Malikk
2013-09-20 09:55:28 [INFO] e[0;31;1mYou are not running the correct version of Craftbukkit for this version of MobCatcher.e[m
2013-09-20 09:55:28 [INFO] e[0;31;1mMobCatcher v3.7 is intended to be run on CB 1.5.1-R0.1-SNAPSHOTe[m
2013-09-20 09:55:28 [INFO] e[0;31;1mExpect major bugs or failure to enable. Please do not report bugs until you are using compatible versions of CB and MobCatcher.e[m
2013-09-20 09:55:28 [INFO] [MobCatcher] Hooked Vault 1.2.24-b304
2013-09-20 09:55:28 [INFO] [MobCatcher] Spout was not found.
2013-09-20 09:55:28 [INFO] [MobCatcher] remove stackability: true
2013-09-20 09:55:28 [SEVERE] Error occurred while enabling MobCatcher v3.7 (Is it up to date?)
java.lang.NoClassDefFoundError: net/minecraft/server/v1_5_R2/Item
    at me.jordan.mobcatcher.MobCatcher.removeStackability(MobCatcher.java:1170)
    at me.jordan.mobcatcher.MobCatcher.onEnable(MobCatcher.java:120)
    at org.bukkit.plugin.java.JavaPlugin.setEnabled(JavaPlugin.java:217)
    at org.bukkit.plugin.java.JavaPluginLoader.enablePlugin(JavaPluginLoader.java:457)
    at org.bukkit.plugin.SimplePluginManager.enablePlugin(SimplePluginManager.java:381)
    at org.bukkit.craftbukkit.v1_5_R3.CraftServer.loadPlugin(CraftServer.java:282)
    at org.bukkit.craftbukkit.v1_5_R3.CraftServer.enablePlugins(CraftServer.java:264)
    at net.minecraft.server.v1_5_R3.MinecraftServer.j(MinecraftServer.java:304)
    at net.minecraft.server.v1_5_R3.MinecraftServer.e(MinecraftServer.java:283)
    at net.minecraft.server.v1_5_R3.MinecraftServer.a(MinecraftServer.java:243)
    at net.minecraft.server.v1_5_R3.DedicatedServer.init(DedicatedServer.java:151)
    at net.minecraft.server.v1_5_R3.MinecraftServer.run(MinecraftServer.java:382)
    at net.minecraft.server.v1_5_R3.ThreadServerApplication.run(SourceFile:573)
Caused by: java.lang.ClassNotFoundException: net.minecraft.server.v1_5_R2.Item
    at org.bukkit.plugin.java.PluginClassLoader.findClass0(PluginClassLoader.java:70)
    at org.bukkit.plugin.java.PluginClassLoader.findClass(PluginClassLoader.java:53)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
    ... 13 more
2013-09-20 09:55:28 [INFO] [Multiverse-Inventories] Enabling Multiverse-Inventories v2.5-b346
2013-09-20 09:55:28 [INFO] [Multiverse-Inventories 2.5-b346] enabled.
2013-09-20 09:55:28 [INFO] [WormholeXTreme] Enabling WormholeXTreme v1.031
2013-09-20 09:55:28 [INFO] [WormholeXTreme][v1.031] Boot sequence initiated...
2013-09-20 09:55:28 [INFO] [WormholeXTreme][v1.031] Wormhole Worlds support disabled in settings.txt, loading stargates and worlds by our self.
2013-09-20 09:55:29 [INFO] [WormholeXTreme] 49 Wormholes loaded from WormholeDB.
2013-09-20 09:55:29 [INFO] [WormholeXTreme] PermissionAlias backend: 'pex' registered!
2013-09-20 09:55:29 [INFO] [WormholeXTreme] PermissionAlias backend: 'bukkit' registered!
2013-09-20 09:55:29 [INFO] [WormholeXTreme] Attempting to use supported permissions plugin 'PermissionsEx'
2013-09-20 09:55:29 [WARNING] [WormholeXTreme] This plugin is not ready yet.
2013-09-20 09:55:29 [INFO] [WormholeXTreme] Initializing bukkit backend
2013-09-20 09:55:29 [INFO] [WormholeXTreme] Config node PERMISSIONS_BACKEND changed to 'pex'
2013-09-20 09:55:29 [INFO] [WormholeXTreme] Initializing pex backend
2013-09-20 09:55:29 [WARNING] [WormholeXTreme] This plugin is not ready yet.
2013-09-20 09:55:29 [INFO] [WormholeXTreme] Attached to PermissionsEx version 1.19.5
2013-09-20 09:55:29 [INFO] [WormholeXTreme][v1.031] Boot sequence completed
2013-09-20 09:55:29 [INFO] [Multiverse-NetherPortals] Enabling Multiverse-NetherPortals v2.5-b660
2013-09-20 09:55:29 [INFO] [Multiverse-NetherPortals] - Version 2.5-b660 Enabled - By Rigby and fernferret
2013-09-20 09:55:29 [INFO] Server permissions file permissions.yml is empty, ignoring it
2013-09-20 09:55:29 [INFO] Done (4.261s)! For help, type "help" or "?"

Here is what the script grabs:

2013-09-20 09:55:28 [SEVERE] Error occurred while enabling MobCatcher v3.7 (Is it up to date?)
java.lang.NoClassDefFoundError: net/minecraft/server/v1_5_R2/Item
        at me.jordan.mobcatcher.MobCatcher.removeStackability(MobCatcher.java:1170)
        at me.jordan.mobcatcher.MobCatcher.onEnable(MobCatcher.java:120)
        at org.bukkit.plugin.java.JavaPlugin.setEnabled(JavaPlugin.java:217)
        at org.bukkit.plugin.java.JavaPluginLoader.enablePlugin(JavaPluginLoader.java:457)
        at org.bukkit.plugin.SimplePluginManager.enablePlugin(SimplePluginManager.java:381)
        at org.bukkit.craftbukkit.v1_5_R3.CraftServer.loadPlugin(CraftServer.java:282)
        at org.bukkit.craftbukkit.v1_5_R3.CraftServer.enablePlugins(CraftServer.java:264)
        at net.minecraft.server.v1_5_R3.MinecraftServer.j(MinecraftServer.java:304)
        at net.minecraft.server.v1_5_R3.MinecraftServer.e(MinecraftServer.java:283)

Here is what I wish the script grabbed instead:

2013-09-20 09:55:28 [INFO] [MobCatcher] Enabling MobCatcher v3.7
2013-09-20 09:55:28 [INFO] [MobCatcher] Author: Malikk
2013-09-20 09:55:28 [INFO] e[0;31;1mYou are not running the correct version of Craftbukkit for this version of MobCatcher.e[m
2013-09-20 09:55:28 [INFO] e[0;31;1mMobCatcher v3.7 is intended to be run on CB 1.5.1-R0.1-SNAPSHOTe[m
2013-09-20 09:55:28 [INFO] e[0;31;1mExpect major bugs or failure to enable. Please do not report bugs until you are using compatible versions of CB and MobCatcher.e[m
2013-09-20 09:55:28 [INFO] [MobCatcher] Hooked Vault 1.2.24-b304
2013-09-20 09:55:28 [INFO] [MobCatcher] Spout was not found.
2013-09-20 09:55:28 [INFO] [MobCatcher] remove stackability: true
2013-09-20 09:55:28 [SEVERE] Error occurred while enabling MobCatcher v3.7 (Is it up to date?)
java.lang.NoClassDefFoundError: net/minecraft/server/v1_5_R2/Item
    at me.jordan.mobcatcher.MobCatcher.removeStackability(MobCatcher.java:1170)
    at me.jordan.mobcatcher.MobCatcher.onEnable(MobCatcher.java:120)
    at org.bukkit.plugin.java.JavaPlugin.setEnabled(JavaPlugin.java:217)
    at org.bukkit.plugin.java.JavaPluginLoader.enablePlugin(JavaPluginLoader.java:457)
    at org.bukkit.plugin.SimplePluginManager.enablePlugin(SimplePluginManager.java:381)
    at org.bukkit.craftbukkit.v1_5_R3.CraftServer.loadPlugin(CraftServer.java:282)
    at org.bukkit.craftbukkit.v1_5_R3.CraftServer.enablePlugins(CraftServer.java:264)
    at net.minecraft.server.v1_5_R3.MinecraftServer.j(MinecraftServer.java:304)
    at net.minecraft.server.v1_5_R3.MinecraftServer.e(MinecraftServer.java:283)
    at net.minecraft.server.v1_5_R3.MinecraftServer.a(MinecraftServer.java:243)
    at net.minecraft.server.v1_5_R3.DedicatedServer.init(DedicatedServer.java:151)
    at net.minecraft.server.v1_5_R3.MinecraftServer.run(MinecraftServer.java:382)
    at net.minecraft.server.v1_5_R3.ThreadServerApplication.run(SourceFile:573)
Caused by: java.lang.ClassNotFoundException: net.minecraft.server.v1_5_R2.Item
    at org.bukkit.plugin.java.PluginClassLoader.findClass0(PluginClassLoader.java:70)
    at org.bukkit.plugin.java.PluginClassLoader.findClass(PluginClassLoader.java:53)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
    ... 13 more

In essence, what I wish it did was grab ALL lines after a "[SEVERE]" tag until it gets to another line that starts with "2013" or a "yyyy-mm-dd" pattern. In addition, I'd like it to grab the 10 lines the precede the [SEVERE] entry to help give me context.

Thanks for any help you can provide!

You said you want 10 lines before the line containing SEVERE, but your sample output only shows 8 lines. Is there a reason why the lines:

2013-09-20 09:55:28 [INFO] [Wither] Enabling Wither v2.0
2013-09-20 09:55:28 [INFO] [Wither] Wither v2.0 enabled!

were not included?

Do you only want context lines if they contain the string "MobCatcher"?

1 Like

I threw out 10 lines as an arbitrary number because it could really vary. I would think that 10 lines would be MORE than I need most of the time. And I wouldn't want to hardcode on "Mobcatcher" as it could be any number of server plugins that could fail or error out.

The idea is for me to be able to troubleshoot and diagnose server issues with this subset of the logfile rather than looking at this logfile, noting the time, and then sifting through the main server.log file to get the context I need to troubleshoot.

---------- Post updated at 05:13 PM ---------- Previous update was at 05:11 PM ----------

I suppose that one could parse the [SEVERE] line and then look for any lines within the previous 10-20 lines that mention any of the words used in the same line as the [SEVERE] tag, but that seems overkill and unnecessary complication.

I was just confused because you said you wanted 10 lines of context before the SEVERE line, but your sample output provided 8 lines instead of 10.

The following awk script seems to do what you requested (with 10 lines of context):

awk -F"[][]" '
# pc() -- print context
# print up to 11 lines of context and clear context.
function pc(    i) {
        for(i = (lc > 10) ? lc - 10 : 1; i <= lc; i++)
                print l
        lc = 0
}
!/^[1-9][0-9]{3}-[01][0-9]-[0-3][0-9]/ {
        nts = 1 # we have found a line with No Time Stamp
        if(severe) {
                pc()    # print context
                print   # print this line (which follows the SEVERE tag).
        }
        next
}
/^[1-9][0-9]{3}-[01][0-9]-[0-3][0-9]/ {
        if(nts) 
                # 1st line after one or more lines with no time stamp...
                severe = nts = lc = 0
        l[++lc] = $0
        if($2 == "SEVERE") severe = 1
}' /minecraft/server.log

If you want to run this on a Solaris/SunOS system, use /usr/xpg4/bin/awk , /usr/xpg6/bin/awk , or nawk instead of awk .

1 Like

My servers run Debian 7.1 (wheezy) 64-bit. I'll give this a try.

---------- Post updated at 10:01 PM ---------- Previous update was at 09:52 PM ----------

I couldn't get that script to produce anything. I added a >filename.log at the end and it produced a 0-byte file.

---------- Post updated at 10:03 PM ---------- Previous update was at 10:01 PM ----------

I added a "set -x" to the beginning of the script to see if that would produce anything helpful:

mc@minecraftserver ~/scripts$ ./test.sh
+ awk '-F[][]' '
# pc() -- print context
# print up to 11 lines of context and clear context.
function pc(    i) {
        for(i = (lc > 10) ? lc - 10 : 1; i <= lc; i++)
                print l
        lc = 0
}
!/^[1-9][0-9]{3}-[01][0-9]-[0-3][0-9]/ {
        nts = 1 # we have found a line with No Time Stamp
        if(severe) {
                pc()    # print context
                print   # print this line (which follows the SEVERE tag).
        }
        next
}
/^[1-9][0-9]{3}-[01][0-9]-[0-3][0-9]/ {
        if(nts)
                # 1st line after one or more lines with no time stamp...
                severe = nts = lc = 0
        l[++lc] = $0
        if($2 == "SEVERE") severe = 1
}' /home/mc/servers/bukkitpvt/server.log

---------- Post updated at 10:07 PM ---------- Previous update was at 10:03 PM ----------

Here is the version information for "awk" for Debian 7.1 if that's helpful.

Debian -- Details of package original-awk in wheezy

With the sample input shown in the 1st message in this thread the awk program I provided produces the output:

2013-09-20 09:55:28 [INFO] [Wither] Enabling Wither v2.0
2013-09-20 09:55:28 [INFO] [Wither] Wither v2.0 enabled!
2013-09-20 09:55:28 [INFO] [MobCatcher] Enabling MobCatcher v3.7
2013-09-20 09:55:28 [INFO] [MobCatcher] Author: Malikk
2013-09-20 09:55:28 [INFO] You are not running the correct version of Craftbukkit for this version of MobCatcher.
2013-09-20 09:55:28 [INFO] MobCatcher v3.7 is intended to be run on CB 1.5.1-R0.1-SNAPSHOT
2013-09-20 09:55:28 [INFO] Expect major bugs or failure to enable. Please do not report bugs until you are using compatible versions of CB and MobCatcher.
2013-09-20 09:55:28 [INFO] [MobCatcher] Hooked Vault 1.2.24-b304
2013-09-20 09:55:28 [INFO] [MobCatcher] Spout was not found.
2013-09-20 09:55:28 [INFO] [MobCatcher] remove stackability: true
2013-09-20 09:55:28 [SEVERE] Error occurred while enabling MobCatcher v3.7 (Is it up to date?)
java.lang.NoClassDefFoundError: net/minecraft/server/v1_5_R2/Item
    at me.jordan.mobcatcher.MobCatcher.removeStackability(MobCatcher.java:1170)
    at me.jordan.mobcatcher.MobCatcher.onEnable(MobCatcher.java:120)
    at org.bukkit.plugin.java.JavaPlugin.setEnabled(JavaPlugin.java:217)
    at org.bukkit.plugin.java.JavaPluginLoader.enablePlugin(JavaPluginLoader.java:457)
    at org.bukkit.plugin.SimplePluginManager.enablePlugin(SimplePluginManager.java:381)
    at org.bukkit.craftbukkit.v1_5_R3.CraftServer.loadPlugin(CraftServer.java:282)
    at org.bukkit.craftbukkit.v1_5_R3.CraftServer.enablePlugins(CraftServer.java:264)
    at net.minecraft.server.v1_5_R3.MinecraftServer.j(MinecraftServer.java:304)
    at net.minecraft.server.v1_5_R3.MinecraftServer.e(MinecraftServer.java:283)
    at net.minecraft.server.v1_5_R3.MinecraftServer.a(MinecraftServer.java:243)
    at net.minecraft.server.v1_5_R3.DedicatedServer.init(DedicatedServer.java:151)
    at net.minecraft.server.v1_5_R3.MinecraftServer.run(MinecraftServer.java:382)
    at net.minecraft.server.v1_5_R3.ThreadServerApplication.run(SourceFile:573)
Caused by: java.lang.ClassNotFoundException: net.minecraft.server.v1_5_R2.Item
    at org.bukkit.plugin.java.PluginClassLoader.findClass0(PluginClassLoader.java:70)
    at org.bukkit.plugin.java.PluginClassLoader.findClass(PluginClassLoader.java:53)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
    ... 13 more

(although the copy and paste processing seems to have lost the terminal color changing escape sequences) when run on a MacBook Pro running OS X. The actual output (including escape sequences) is attached.

There is nothing in this awk script that depends on any awk feature that is not required by the standards.

1 Like

weird... so I just grabbed my original data sample (that you're using) and saved that as "server2.log" and redirected the last line of the script to server2.log. Still no results.

---------- Post updated at 10:30 PM ---------- Previous update was at 10:28 PM ----------

Just to check, I switched top line of script from "#!/bin/bash" to "#!/bin/sh". Still no difference.

---------- Post updated at 10:34 PM ---------- Previous update was at 10:30 PM ----------

I only modified the path line that I know and added the set-x debug line. I did have it > to a file for a bit, but here's how it is now.

mc@minecraftserver ~/scripts$ cat test.sh
#!/bin/sh

set -x

awk -F"[][]" '
# pc() -- print context
# print up to 11 lines of context and clear context.
function pc(    i) {
        for(i = (lc > 10) ? lc - 10 : 1; i <= lc; i++)
                print l
        lc = 0
}
!/^[1-9][0-9]{3}-[01][0-9]-[0-3][0-9]/ {
        nts = 1 # we have found a line with No Time Stamp
        if(severe) {
                pc()    # print context
                print   # print this line (which follows the SEVERE tag).
        }
        next
}
/^[1-9][0-9]{3}-[01][0-9]-[0-3][0-9]/ {
        if(nts)
                # 1st line after one or more lines with no time stamp...
                severe = nts = lc = 0
        l[++lc] = $0
        if($2 == "SEVERE") severe = 1
}' /home/mc/servers/bukkitpvt/server.log
mc@minecraftserver ~/scripts$ ./test.sh
+ awk -F[][]
# pc() -- print context
# print up to 11 lines of context and clear context.
function pc(    i) {
        for(i = (lc > 10) ? lc - 10 : 1; i <= lc; i++)
                print l
        lc = 0
}
!/^[1-9][0-9]{3}-[01][0-9]-[0-3][0-9]/ {
        nts = 1 # we have found a line with No Time Stamp
        if(severe) {
                pc()    # print context
                print   # print this line (which follows the SEVERE tag).
        }
        next
}
/^[1-9][0-9]{3}-[01][0-9]-[0-3][0-9]/ {
        if(nts)
                # 1st line after one or more lines with no time stamp...
                severe = nts = lc = 0
        l[++lc] = $0
        if($2 == "SEVERE") severe = 1
} /home/mc/servers/bukkitpvt/server.log
mc@minecraftserver ~/scripts$

You dropped the single quote ending the awk script. Change the last line in test.sh from:

} /home/mc/servers/bukkitpvt/server.log

to:

}' /home/mc/servers/bukkitpvt/server.log

and try again.

1 Like

Actually, that ' is still there. the previous post of mine consisted of two things, the script "via cat" and the output of the script (due to the "set -x") at the top of the script. If you look half way through that code window, you'll see the ' is still there.

The set -x shows you the command the shell is running; it does not trace commands running inside awk.

I'm grasping at straws here. Try changing the lines in my script:

!/^[1-9][0-9]{3}-[01][0-9]-[0-3][0-9]/ {
    and
/^[1-9][0-9]{3}-[01][0-9]-[0-3][0-9]/ {

to:

!/^[1-9][0-9][0-9][0-9][-][01][0-9][-][0-3][0-9]/ {
    and
/^[1-9][0-9][0-9][0-9][-][01][0-9][-][0-3][0-9]/ {

respectively.
If that doesn't work, we can try adding some printf statements in the awk script to trace what is going on in the awk script. But, trying to debug a script on a system I can't touch is frustrating when the script works perfectly on my system.

1 Like

Don,

I won't be offended if you're done with this thread. You gave it a solid run. I don't ever expect the amount of effort you've given on forums like this. And I certainly don't feel entitled to your time.

IF you're interested (big IF), you can gain access to the same OS by doing a virtual machine. You'd be up and running in 10 minutes or less:

But I don't expect that. You've been MORE than generous with your time.

Thanks.

---------- Post updated at 08:57 AM ---------- Previous update was at 08:47 AM ----------

I spoke too soon, Don!

Your last code change worked! This script worked:

#!/bin/bash

set -x

awk -F"[][]" '
# pc() -- print context
# print up to 11 lines of context and clear context.
function pc(    i) {
        for(i = (lc > 10) ? lc - 10 : 1; i <= lc; i++)
                print l
        lc = 0
}
!/^[1-9][0-9][0-9][0-9][-][01][0-9][-][0-3][0-9]/ {
        nts = 1 # we have found a line with No Time Stamp
        if(severe) {
                pc()    # print context
                print   # print this line (which follows the SEVERE tag).
        }
        next
}
/^[1-9][0-9][0-9][0-9][-][01][0-9][-][0-3][0-9]/ {
        if(nts)
                # 1st line after one or more lines with no time stamp...
                severe = nts = lc = 0
        l[++lc] = $0
        if($2 == "SEVERE") severe = 1
}' /home/mc/servers/bukkitpvt/server.log >test.log

Thank you SO MUCH for all your hard work and effort! I can't tell you enough how much I appreciate your selfless donation of your time. I am nowhere near the level (yet?) to be able to compose a tool like this and you've made my life so much easier!

To get many of the awk version to work with code like this [0-9]{3} , you need to add --posix .
Eks

awk --posix '/^[0-9-]{3}/' file

This should make the original code to work.

1 Like

Hi Jotne,
Thanks for the information. Note, however, that adding the --posix long option to awk on a system that actually conforms to the POSIX standards is likely to give you an unknown option diagnostic rather than a working awk script.

Oh, well.

I have run into a new issue. There are occasionally "[WARNING]" messages that I care about as much as "[SEVERE]" messages. Thus, I would like to be able to trigger on more than just "SEVERE". How do I trigger on more than just that?

I'm thinking of triggering on these so far:

  • SEVERE
  • java.lang.ClassCastException (or possibly just "java.lang.Class*" as there should never be any of that in a happy log file)
  • generated an exception

Of course, if I start to overlap with "SEVERE" then I may just have to use other triggers instead. Not sure.

Thanks in advance for any help you can provide.

The changes you are suggesting require a completely different aproach than the script I provided before uses.

It really isn't fair to those of us who want to help you to say that you're thinking about a list of triggers. Let us know when you've thought about it enough to give us solid requirements.

The issues that were raised when you started this thread seem to have been resolved. When you can show us representative input data, corresponding desired output, and a complete set of requirements for this new problem, please start a new thread to discuss it.

Fair enough. Sorry. Didn't mean to offend or break the rules. Thank you.