Yes, GNU awk (because strftime, mktime are GNU extensions) is one of the ways to go; python and perl are also appropriate.
I just finished this script, copy the entire code tag and make it a file in your path ( "date-tail" or "logtail" are good names for it). Then do a `chmod u+x <file>' to make it executable and you are ready to go. Examples are given after the code.
Code:
#!/usr/bin/gawk -f
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 3 of the License, or (at your
# option) any later version.
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the "Free Software Foundation, Inc.,
# 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA"
function month_cvt(month)
{
return sprintf( "%02d", (2 + \
match("JanFebMarAprMayJunJulAugSepOctNovDec", month)) / 3 )
}
function time_cvt(time)
{
return gensub(/:/, " ", "g", time)
}
# Check input variables
NR == 1 {
if (year == "")
year = strftime("%Y", systime())
if (month == "" || day == "" )
{
print "either 'month' or 'day' were not specified." > stderr
exit 1
}
if (time == "")
time = "00:00:00"
argstamp = year " " month_cvt(month) " " day " " time_cvt(time)
}
{
logstamp = year " " month_cvt($1) " " $2 " " time_cvt($3)
if (mktime(logstamp) >= mktime(argstamp))
print
}
Usage (items enclosed in [] are optional):
Code:
date-tail [year=NUMBER] month=Mon day=NUMBER [time=HH:MM:SS]
If not supplied, year defaults to current one and time to 00:00:00.
Month must be supplied as three letter abbreviation with first one capitalised.
Examples (with pipe or argument):
Code:
cat auth.log | date-tail month=Sep day=10 time=17:08:50
date-tail month=Sep day=10 time=17:08:50 auth.log
[/CODE]
Bookmarks