How to split a large file

[Unix Administrator_9]

Hi,

I'm looking for a way I can split an Oracle alert log based on month. Currently I go into vi, create a new file with the data required, and then purge out of the current alert log. I've currently got an alert log which is about 420Mb in size. I would like to be able to delete all lines upto, say 1/8/04.

Any suggestions?

TIA,
Scott Taylor.

[Stefan Schulz]

Hi,

for splitting a file based on expressions have a look at csplit. This will allow you to split the log file based on Dates in this file.

For deleting up to an date i would use perl. this is flexible and capable of handling large files.

Hope this helps

Regards Stefan

[Sanjay Kumar Suri]

No straight way.

Find out the line number from where you want to keep the alert log. Then use tail command

tail -nline_number alert_log>new_alert_log
mv alert_log old_alert_log
mv new_alert_log alert_log

sks

[Ramalingam]

Hi ,
You can try 'csplit' with regexpression
You can scan for a regex then delete all lines preceding it ..

csplit /regex/+

See man csplit
HTH
Regards,
Ram.

[Franky_1]

Hi Scott,

basically you can split up a large file with the equally named "split" command where you can determine the size of the pieces by your own.
In your special case you can use
vi
:set number (show line numbering)
then search the first line you want to keep (eg. 120000)
then type 1G (top of file) and type 120000dd
this will delete the first 120000 lines and let you just the rest you want to keep.
Maybe there are better solutions, but at least it works :-)

Regards

Franky

[Ravi_8]

Hi Scott

open the log file using vi
:setnu
assign the numbers to each line, check for the lines upto 1/8/04 (note the line number)

spilt -l

[Thierry Poels_1]

hi,

how to split the alert file by month? Simple: start a cronjob each first or last minute of the month and move the file.

Personally I cut off the first n lines when the alert file exceeds a specified size.

regards,
Thierry.

[Muthukumar_5]

we can do it simply with sed as,

To get this month informations,

sed -e ,!d org-file >> backupfile

To purge that details from original files,

echo "`sed -e ,d org-file`" > org-file

-- muthu --

[V. Nyga]

Hi Scott,

for me cat (or more) works:
cat "alert log" | grep "string defining your month" > "new file"

HTH
Volkmar

[Kent Ostby]

Scott --

You can use awk as well to do something like this (although awk has a limit to the max fields per line that can sometimes mess you up).

If you post the layout of the file (say a few sample lines) so I can see what the date string looks like, I could probably whip up a script in short order.

Best regards,

Kent M. Ostby

[Hein van den Heuvel]

Hmmm... this problem is much similar to:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=654588

Oracle alert files have times stamps like:
Fri Jun 25 14:19:13 2004

I'd use a perl script (let's call it alert-by-month.pl) similar to

if (/^\w+\s+(\w+)\s+\d+\s\d+:/) {
if ($month ne $1) {
$month = $1;
open(M,">alert_$month.log") or die;
}
}
print M;

So it looks for lines starting with a word [the day: \w+] followed by whitespace.
It remembers the next word in $1 [the month: (\w+)]
Then, to be sure it is a date stamp is looks for whitespace, numbers, whitespace, numbers, colon" : [day,hour,":" : \s+\d+\s\d+: ]

When it sees that, it compares the new month (in $1) with the current month.
If it is a new month (like the first line!), then it makes that the current month and opens a new output file.
Finally it prints the line on the current file.



Now exectute with:

perl -n alert-by-month.pl alert

Good luck.

Hein

[Kent Ostby]

Scott -- using the data provided above, here is a solution.

Create a script file called "do":

echo MONTH $1 > .do1
cat $2 >> .do1
awk -f pull_month.awk < .do1 > .do3
mv .do2 archived_data.log
mv .do3 new_data.log
rm .do1

Create an awk file called pull month :

/^MONTH/ {targetmonth=$2;next;}
$2==targetmonth {print $0 > ".do2";next}
{print $0}

Run it as:

do Jun

Example:

do Jun usek

usek contains:
Fri Jun asdf asdf asdf asdfasdf
Fri Jun asdf asdf asdf asdfasdf
Fri Jul asdf asdf asdf asdfasdf
Fri Jul asdf asdf asdf asdfasdf
Fri Aug asdf asdf asdf asdfasdf
Fri Aug asdf asdf asdf asdfasdf

after the run, archived_data_log contains:

Fri Jun asdf asdf asdf asdfasdf
Fri Jun asdf asdf asdf asdfasdf

after the run, new_data_log contains:
Fri Jul asdf asdf asdf asdfasdf
Fri Jul asdf asdf asdf asdfasdf
Fri Aug asdf asdf asdf asdfasdf
Fri Aug asdf asdf asdf asdfasdf