grep latest time messages from the syslog

[Ho_5]

Hi,

In the syslog there are several times "named restart" messages, but I want to grep the latest

time "named restart" messages from the syslog.
The question is how?? I want to grep the messages which starts with "starting (/etc/named.conf)" and end on Ready "to anwser queries"

e.g.
Nov 20 11:53:01 dns2 named[21345]: starting (/etc/named.conf). named 8.2.5-T1A
etc..etc..
etc..
etc..etc.
Nov 20 11:53:02 dns2 named[21346]: Ready to answer queries.

Regards,

John

[Steven E. Protter]

tail 50 /var/adm/syslog/syslog.log
Last 50. You can run this through grep if there is anything you are looking for.l

tail 50 /var/adm/syslog/syslog.log | grep -i error


tail -f /var/adm/syslog/syslog.log

continuous stream as they happen. I keep this in a terminal window when I suspect a system is getting ready to make trouble.

SEP

[Ho_5]

I don't want to use tail command.
Because I don't know where exactly it happenes.
I want to search throught the whole syslog to grep the latest "named restart".
not only one syntax/line, but all data from "starting..." to "Read"...y.

//john

[Hein van den Heuvel]

Perl! If you spot a new begin, forget a prior text and start adding new text. If you spot an end, stop adding text. At the end, print text (if any).

hth,
Hein.


#!/usr/bin/perl
while (<>) {
if (/named\[\d+\]: start/) {
undef @x;
$go = 1;
}
push (@x, $_) if ($go);
$go = 0 if (/named\[\d+\]: Ready/);
}
print foreach (@x);

[Graham Cameron_1]

I would use awk to capture the lines between your 2 strings, then print out the last captured set, like this:

awk '
BEGIN {linescaught=0}
$0 ~ /named/ && $0 ~ /starting/ { # Start of text
split ("", namedlines) # Empty the array
capturing = 1
linescaught = 0
}
(capturing > 0) {namedlines[++linescaught] = $0}
$0 ~ /named/ && $0 ~ /Ready/ { # End of text
capturing = 0
}
END { for (i=1;i<=linescaught;i++) print (namedlines[i]) }
' /var/adm/syslog/syslog.log

-- Graham