Easy way to extract Logs on a Date/Line Range in LINUX

Example: range of date to be extracted in the /var/log/message. Oct 26-27
our x will be Oct 26, y will be Oct 27

1. Get the first line number which will be our x reference (x - Oct 26).

$ grep -n 'Oct 26' /var/log/messages | head

The initial reference of x = 29933

Sample Output:

29933:Oct 26 00:00:00 postfix nagios: LOG ROTATION: DAILY
29934:Oct 26 00:00:00 postfix nagios: LOG VERSION: 2.0
29935:Oct 26 00:00:00 postfix nagios: CURRENT HOST STATE: localhost;UP;HARD;1;PING OK - Packet loss = 0%
29936:Oct 26 00:00:00 postfix nagios: CURRENT SERVICE STATE: localhost;Current Load;OK;HARD;1;OK
29937:Oct 26 00:00:00 postfix nagios: CURRENT SERVICE STATE: localhost;Current Users;OK;HARD;1
29938:Oct 26 00:00:00 postfix nagios: CURRENT SERVICE STATE: localhost;HTTP;WARNING
29939:Oct 26 00:00:00 postfix nagios: CURRENT SERVICE STATE: localhost;PING;OK;HARD;1;PING OK - Packet loss = 0%
29940:Oct 26 00:00:00 postfix nagios: CURRENT SERVICE STATE: localhost;Root Partition;OK;HARD;1;DISK OK - free space
29941:Oct 26 00:00:00 postfix nagios: CURRENT SERVICE STATE: localhost;SSH;OK;HARD;1;SSH OK
29942:Oct 26 00:00:00 postfix nagios: CURRENT SERVICE STATE: localhost;Swap Usage;OK;HARD;1;


2. Get the last line number which will be our y reference (x - Oct 27).

$ grep -n 'Oct 27' /var/log/messages | tail

The last reference of y = 89712

Sample Output:

89703:Oct 27 23:59:14 postfix snmpd[18448]: -- IF-MIB::ifPhysAddress.1
89704:Oct 27 23:59:16 postfix snmpd[18448]: Connection from UDP: [192.168.0.x]:1055
89705:Oct 27 23:59:26 postfix last message repeated 15 times
89706:Oct 27 23:59:36 postfix snmpd[18448]: Connection from UDP: [192.168.0.131]:4118
89707:Oct 27 23:59:36 postfix snmpd[18448]: Received SNMP packet(s) from UDP: [192.168.0.x]:4118
89708:Oct 27 23:59:36 postfix snmpd[18448]: send response: Failure in sendto
89709:Oct 27 23:59:36 postfix snmpd[18448]: -- SNMPv2-MIB::sysObjectID.0
89710:Oct 27 23:59:36 postfix snmpd[18448]: -- IF-MIB::ifPhysAddress.1
89711:Oct 27 23:59:36 postfix snmpd[18448]: Connection from UDP: [192.168.0.x]:1055
89712:Oct 27 23:59:56 postfix last message repeated 23 times

3. Use the x,y reference to extract the file : x = 29933, y =89712

$ sed -n '29933,89712p' /var/log/messages
> newfilename

Comments

Popular posts from this blog

Scraping an Entire Website using LINUX

How to enable clustering in Openfire Enterprise?

Google Sitemap Generator Installation in a CentOS Platform