Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Escaping slashes in bash (awk)

Trying to grab a line and all following lines from an Apache log file I'm hoping to simplify the following:

# Convert epoch to format used in log file
gtime=$(date -d @$etime +"%d/%b/%Y:%T")  # "17/Nov/2015:16:36:45"
# Escape the slashes
g_tim=$(echo $gtime | sed 's/\//\\\//g') # "17\/Nov\/2015:16:36:45"
# Grab 
lines=$(awk '/$g_tim/,0' access.log)

It would be nicer if I didn't have to use two variables for this and I'm sure I'm committing various other sins to boot.

Sample lines of log file:

djerk.nl:80 79.134.133.108 - - [17/Nov/2015:18:51:52 +0100] "GET /wordpress/2015/null HTTP/1.1" 103 16544 "http://www.djerk.nl/wordpress/2015/cisco-lacp-config-for-aruba-ap" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36"
djerk.nl:80 92.27.44.117 - - [17/Nov/2015:18:52:28 +0100] "GET /djerk_nl.pac HTTP/1.1" 403 1147 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36"
like image 986
dmgeurts Avatar asked Nov 26 '25 21:11

dmgeurts


2 Answers

You want to print everything from the line matching 17/Nov/2015:16:36:45 up to the end. Then, why don't you use this syntax?

awk '$0 ~ /pattern/ {f=1} f' file

This sets a flag when the pattern is first seen. From that moment on, f condition is True, so that all the lines are printed up to the end of the file.

In your case,

awk -v date="$(date -d @$etime +"%d/%b/%Y:%T")" '$0~date {f=1}f' file
like image 163
fedorqui 'SO stop harming' Avatar answered Nov 29 '25 16:11

fedorqui 'SO stop harming'


From your comments it sounds like you don't REALLY want to grab a line and all following lines but instead you want to print all lines starting on or after a given timestamp. That would be:

$ cat tst.awk
BEGIN { FS="[][ /:]+"; mths="JanFebMarAprMayJunJulAugSepOctNovDec" }
f { print; next }
{ logTime = sprintf("%04d%02d%02d%02d%02d%02d",$8,(match(mths,$7)+2)/3,$6,$9,$10,$11) }
logTime >= tgtTime { f=1 }

$ awk -v tgtTime="$(date -d @"$etime" +"%Y%m%d%H%M%S")" -f tst.awk file

Note that I changed the date time spec args to produce the new timestamp format for comparison.

like image 34
Ed Morton Avatar answered Nov 29 '25 15:11

Ed Morton



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!