Preserve space in variable of AWK

Shell Programming and Scripting
1

This seems to be a stupid basic question, but I cant get the space to stick in the awk variable.

I do use this command to grep a time range of the log file.

cat /var/log/daemon.log | awk '$0>=from&&$0<=to' from="$(date +%b" "%e" "%H:%M:%S -d -24hour)" to="$(date +%b" "%e" "%H:%M:%S)"

I now have problem with short dates like 1

date +%b" "%e" "%H:%M:%S

gives

Feb  1 18:00:11

This is what i need, the two space between Feb and 1

to="$(date +%b" "%e" "%H:%M:%S)"
echo $to
Feb 1 18:02:43

to='$(date +%b" "%e" "%H:%M:%S)'
echo $to
$(date +%b" "%e" "%H:%M:%S)

to="$(date +%b' '%e' '%H:%M:%S)"
echo $to
Feb 1 18:06:10

First gives 1 space, second do not evaluate the command, third do give 1 space

2

Try:

to=$(date +%b" "%e" "%H:%M:%S)
echo "$to"
1 Like
3

This command do give correct in command line, but how to get it into awk

to and from does not work in awk without " " or ' ' around variable

cat /var/log/daemon.log | awk '$0>=from&&$0<=to' from=$(date +%b" "%e" "%H:%M:%S -d -24hour) to=$(date +%b" "%e" "%H:%M:%S)
awk: cmd. line:1: fatal: cannot open file `31' for reading (No such file or directory)

change

'$0>=from&&$0<=to'

to

'$0>="from"&&$0<="to"'

does not help

Edit, this does not work:

'$0>="$from"&&$0<="$to"'
4 
to="$(date +%b" "%e" "%H:%M:%S)"
5

That is what i do use, if you look at first code.
Script do work fine for all January (two digit date), and stopped 1 February. I did make it some weeks ago.

Log file is growing with several lines every minutes, so I know data is there, but can not get any data for February. (gives no output)
Ubuntu 10.10

6

You cannot compare 'dates' in the form of: Feb 1 18:00:11 - regardless of the extra space. You're comparing strings, which makes no sense.
You need to convert both values ($0 and to/from) to integers and compare integer values:

date +%Y%m%d%H%M%S
7

Thanks, but how to get it all into awk.
Strange is that it has worked in January if you say it should not work.
I do use the log to et value for munin to graph it, so I do have nice graphs until 1 feb.

8

It "worked" because compared strings within 1 month (January).
When the month rolled into February, the string comparison doesn't work any more, because 'Feb' comes before 'Jan' alphabetically.

What're your sample records from the daemon.log?

9 
Feb  1 22:07:53 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:07:53 server2 snmpd[800]: last message repeated 8 times
Feb  1 22:07:57 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:07:57 server2 snmpd[800]: last message repeated 92 times
Feb  1 22:08:13 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:08:13 server2 snmpd[800]: last message repeated 2 times
Feb  1 22:08:13 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:08:25 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:08:25 server2 snmpd[800]: last message repeated 6 times
Feb  1 22:09:05 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:09:35 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:09:57 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:10:13 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:10:13 server2 snmpd[800]: last message repeated 3 times
Feb  1 22:10:43 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:10:43 server2 snmpd[800]: last message repeated 5 times
Feb  1 22:11:05 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:11:35 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]
Feb  1 22:11:57 server2 snmpd[800]: Connection from UDP: [10.10.10.32]:50618->[10.10.10.33]

My goal is to get only some time specific part of the log. Eks. last 24 hours

10 
nawk -v from='Feb  1 22:09:35' -v to='Feb  1 22:11:35'  -f  jot.awk myLogFile

jot.awk:

function convDate(m,d,t)
{
  gsub(":","",t)
  return sprintf("%0.2d%0.2d%s",monA[toupper(m)],d,t)
}

BEGIN {
   mon="JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC"
   monN=split(mon, monA, "|");
   for(i=1; i<=monN; i++) {
     monA[monA]=i;
     delete monA;
   }

   split(from,fromA,FS)
   split(to,toA,FS)
   fromI=int(convDate(fromA[1], fromA[2], fromA[3]))
   toI=int(convDate(toA[1], toA[2], toA[3]))
}
{
   d=int(convDate($1,$2,$3))
   if (d>=fromI && d<=toI) print
}
1 Like