how to select the content with sed in linux shell

Question

In my project, I have a linux file: audit_check.log

The content of audit_check.log is like:

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD
2019-01-08 15:10:30,root     pts/0        2019-01-08 11:30 ,root,vm1, 3115  cat /var/log/audit_check.log,/root/USER_CD
2019-01-08 15:10:51,root     pts/0        2019-01-08 11:30 ,root,vm1, 3116  echo yang > xie,/root/USER_CD
2019-01-08 15:10:54,root     pts/0        2019-01-08 11:30 ,root,vm1, 3117  rm -rf xie,/root/USER_CD
2019-01-08 15:10:56,root     pts/0        2019-01-08 11:30 ,root,vm1, 3118  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:11:35,root     pts/0        2019-01-08 11:30 ,root,vm1, 3119  vi keycmd.sh ,/root/USER_CD
2019-01-08 15:11:39,root     pts/0        2019-01-08 11:30 ,root,vm1, 3120  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:11:39,root     pts/0        2019-01-08 15:09 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD
2019-01-08 15:12:39,root     pts/0        2019-01-08 11:30 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD

Now, I want to select all lines in the same minute.

for example, when timestr is:

2019-01-08 15:09

the correct result should be:

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD

But the line:

2019-01-08 15:11:39,root     pts/0        2019-01-08 15:09 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD

is exclude in result.

I have tried:

timestr=`date +%Y-%m-%d" "%H:%M`

 sed -n '/^$timestr/p' /var/log/audit_check.log  > /tmp/keycmdtmp.log

but /tmp/keycmdtmp.log is empty. When i remove "^" like:

timestr=`date +%Y-%m-%d" "%H:%M`

sed -n '/$timestr/p' /var/log/audit_check.log  > /tmp/keycmdtmp.log

the result is changed to :

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD
2019-01-08 15:11:39,root     pts/0        2019-01-08 15:09 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD

It seems nothing wrong, who can help me?

Answer 1

This is better suited for awk:

awk -F, -v dt="$(date '+%Y-%m-%d %H:%M')" '$1 ~ dt' file

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD