date: extra operand %d' error

Question

I have a text log file, the format is like the following

Thread-28689296: Thu Aug 25 15:18:41 2016 [ info ]: xxxxx xxxxxx xxxxx

So I want to run cron job to find some certain error messages in last a few minutes. I wrote the following command

awk -vDate=`date +%b %d %H:%M:%S %Y` -vDate2=`date --date="2 minutes ago" +%b %d %H:%M:%S %Y` '$5 > Date && $5 < Date2' /var/log/dummy.log  | grep "Fatal"

In the above command, i search for messages that have a timestamp beween time now and 2 minutes ago with a string Fatal.

But I got the following error

date: extra operand %d'
Try date --help' for more information.
date: extra operand %d'
Try date --help' for more information.

If I run date commands, I got the results as the following

date "+%b %d %H:%M:%S %Y"
Aug 25 15:25:01 2016

date --date="2 minutes ago" +"%b %d %H:%M:%S %Y" 
Aug 25 15:31:42 2016

So the date commands in my awk script should be okay.

I also want to redirect the found error messages happening 2 minutes to a file to mail as alert but I did not get that far yet.

Please kindly advice me what is wrong in my awk script. Thanks a lot in advance!

Answer 1

The problem here is with date itself. Let's see how.

You are saying:

vDate2=`date --date="2 minutes ago" +%b %d %H:%M:%S %Y`

Because you want to use

date --date="2 minutes ago" +%b %d %H:%M:%S %Y

However, if you try to run it you'll see that you get the error:

date: extra operand ‘%d’
Try 'date --help' for more information.

The problem is that you need to enclose the FORMAT controls within double quotes:

#                             v                  v
$ date --date="2 minutes ago" "+%b %d %H:%M:%S %Y"
Aug 25 14:49:31 2016

When this is done, all together your full awk one-liner can be:

awk -v Date="$(date "+%b %d %H:%M:%S %Y")" \
    -v Date2="$(date --date="2 minutes ago" "+%b %d %H:%M:%S %Y")" \
     '$5 > Date && $5 < Date2' file

Note I am using -v Date="$(date ...)":

• $( ) for process substitution, since backticks ` are almost deprecated, ir at least considered legacy.
• date=" things " to prevent errors if the content has spaces.
• v var=value using spaces after -v, since -vvar=value is gawk-specific.