CODEWITHSUNDEEP
shellunixawklog-shipping
HackSparrow
HackSparrow

Reputation: 27

Shell Script to extract logs for last 24 hrs

We are trying to extract logs from a file, we need all entries which meets a pattern and the time stamp is within last 24 hrs.

my log looks like this:

2014-07-01 01:15:59,486 WARN 86c9c59c-c362-48d5-bd8c-fb4c8b616f5a 169.179.101.7 CITIKYC_164283 stence.audit.support.impl.AuditUtilsImpl: 274 - Audit updates are successful

2014-07-01 01:15:59,487 WARN 86c9c59c-c362-48d5-bd8c-fb4c8b616f5a 169.179.101.7 CITIKYC_164283 stence.audit.support.impl.AuditUtilsImpl: 173 - Duplicate reg istration, skipping...

2014-07-01 01:15:59,488 Blah Blah..

so far, we got the logs of previous day 

D=$(date +"%Y-%m-%d" -d "-1 days")
cat citikyc.log | awk '/'$D' /, /'$D' / { print $0 }' | grep "Exception\|at.*\.java\:.*" | mail -s "TESTING" [email protected]

Please help us to fetch the log for last 24hours.

Thanks in Advance...!!

Upvotes: 1

Views: 4029

Answers (2)

Kent
Kent

Reputation: 195049

give this one-liner a try:

awk -v d="$(date -d'24 hours ago' +'%F %T,000')" '$1" "$2>=d &&/YourSearch/' log

I didn't test, I hope no typo was made.

the date -d'24 hours ago' +'%F %T,000' will give you the timestamp 24hr ago from current.

YourSearch is your search pattern (regex).

add a test to show how it worked:

#this is my current time
kent$  date +'%F %T'
2014-07-02 15:27:46

#file content, so only last 3 lines are in "last 24 hours"
kent$  cat f
2014-06-01 01:15:59,123 foo
2014-07-01 02:15:59,123 bar bar bar
2014-07-01 01:15:59,123 foo
2014-07-01 02:15:59,123 foo
2014-07-01 03:15:59,123 foo
2014-07-01 21:15:59,123 foo
2014-07-01 22:15:59,123 foo
2014-07-01 23:15:59,123 foo

#let's get them
kent$  awk -v d="$(date -d'24 hours ago' +'%F %T,000')" '$1" "$2>=d &&/foo/' f
2014-07-01 21:15:59,123 foo
2014-07-01 22:15:59,123 foo
2014-07-01 23:15:59,123 foo

Upvotes: 4

user3442743
user3442743

Reputation:

Full awk.
This should work.
Converts into epoch then tests against current time also in epoch, this is accurate to seconds.

awk 'NF&&/yoursearch/{split($1,d,"-");split($2,t,":");epoch = mktime(d[1]" "d[2]" "d[3]" "t[1]" "t[2]" "t[3])}(systime()-epoch)<86400{print} ' log

Upvotes: 0

Related Questions