Read text file from a specified string to the end of the file.

[bsraj]

Hi All,

I like to read the log file from specific time to end of the file.

eg:
message0
date and time0
message 1
date and time1
message 2
EOF

I want to read all the text (Messages) after date and time0 to end of the file.
Please let me know the UNIX command to perform this?.

Thanks,
bsraj.

[VK2COT]

Hello,

It can be done in many, many ways (Sed, Perl,
Awk, and so on). I am sure our colleagues
in the Forum will flood you with responses :)

Since I am on holidays (sigh, why am I
then still logging infor HP Forums :)),
here are two simple methods in Awk (I am not
sure which version of Awk you use):

awk '/date and time0/,EOF {getline;print}'

or

awk /date and time0/,0 {getline;print}'

Cheers from sunny and hot Sydney - Australia,

VK2COT

[bsraj]

Hi,

Thanks for your response.
I am trying to read the log file (from the specified data and time ) using my K-Shell script and i am creating a new temp file with only the contents after the specified date and time.

Thanks,
bsraj.

[VK2COT]

Hello,

That is fine.

You simply put the folloiwiung line in your Ksh script. Sometjhing along the followiung line:

#!/bin/ksh

PATH=/usr/bin:/sbin:/bin
export PATH

INPUTLOG="/somedir/mylogfile.txt"
OUTFILE="someotherdir/results.txt"

if [ -s "$INPUTFILE" ]
then
awk '/date and time0/,EOF {getline;print}' $INPUTFILE >$OUTFILE
if [ $? -ne 0 ]
then
echo "WARNING: Command awk failed"
exit 1
fi
fi
exit 0

If you are happy with the solution please do
not forget to assign points before closing the thread :)

Cheers,

VK2COT

[bsraj]

Hi VK2COT,

I appreciate your help, but again I am having some issues.
I am getting the following error
awk: syntax error near line 1
awk: bailing out near 1
and I am not sure this is because of the spaces in between the date and time.

Please find my sample code.

#! /bin/ksh
set -x

LogFile="/tmp/scan_log.log"
LoadFile="/tmp/new_scan_log.log"
Last_Alert="Alert: Fri Jan 4 16:15:01 2008"

if [ -s "$LogFile" ]
then
awk '/$Last_Alert/,EOF {getline;print}' $LogFile >> $LoadFile
fi
exit 0


Thanks,
bsraj

[VK2COT]

Hello again,

You awk line does not escape the search string.
Try this:

awk '/'"$Last_Alert"'/,EOF {getline;print}' $LogFile >> $LoadFile

VK2COT

[Dennis Handly]

>VK2COT: awk '/'"$Last_Alert"'/,EOF {getline;print}' $LogFile >> $LoadFile

I'm not sure why you have EOF? It seems this is just the empty string. Also your getline causes it to skip every other line.

If you want to start from your $Last_Alert you can use sed:
$ sed -n "/$Last_Alert,$/p" $LogFile >> $LoadFile

[Pete Randall]

From "Handy One-Liners for Sed" (attached):

# print section of file from regular expression to end of file
sed -n '/regexp/,$p'


Pete

[VK2COT]

Hello,

Dennis is right: getline is not needed as
it prints every second line only.

This works 100%:

awk '/'"$Last_Alert"'/,EOF {print}' $LogFile >> $LoadFile

You need "EOF" or "0" string because
otherwise you only get a matching line.

Cheers,

VK2COT

[bsraj]

Hi All,

Thanks for all your details. I am still getting the same error when using the awk command, but using the below command i am able to list all the details..
sed -n "/^$Last_Alert/,$ p" $LogFile >> $LoadFile.

But the above command is listing including the specified string.
Please let me is there any way to list the error messages after the specified date and time. (Thu Jan 10 12:56:50 2008)
eg:
Thu Jan 10 12:56:49 2008
err0
Thu Jan 10 12:56:50 2008
err1
Thu Jan 10 12:56:51 2008
err2

if Last_Alert = Thu Jan 10 12:56:50 2008 then, the next time i like to list all the errors only after that.
eg
Thu Jan 10 12:56:51 2008
err2

Thanks,
bsraj.

[Dennis Handly]

>the next time i like to list all the errors only after that.

What is the exact format of the file? Is it one line for the time and one line for the message? If you only want to skip 2 lines you can do:
$ sed -n "/^$Last_Alert/,$p" $LogFile | tail +3 >> $LoadFile.

[bsraj]

Hi,

Its actually the system log file, so there will be multiple lines at a same date and time.
So I like to get all the messages after my last date and time.
I am not sure how to increase the time by one sec to the results.

Thanks,
bsraj.

[Dennis Handly]

>It's actually the system log file, so there will be multiple lines at a same date and time.
>So I like to get all the messages after my last date and time. I am not sure how to increase the time by one sec

Thinking like this you say to yourself that you need to do some complex programming but it turns out it is simple:
$ sed -n "/^$Last_Alert/,\$p" $LogFile | grep -v "^$Last_Alert" >> $LoadFile

[VK2COT]

Hello,

The sed(1) or Perl option are probably best.

However if GNU awk(1) is used, then it still possible (this is one long line!):

awk '/'"$Last_Alert"'/,EOF {arr[NR]=$0; n=length(arr)} END {m=NR-n+2; for (m; m<=NR; m++) {print arr[m]}}' $LogFile >> $LoadFile

This works in GNU awk. I do not have access
to HB-UX server to check nawk or original version of awk, as I am on holidays at the moment (just Linux server at home :)).

Cheers,

Vk2COT

[Dennis Handly]

>This works in GNU awk.

This doesn't work with awk nor with gawk 3.1.4.
It doesn't like length(arr).

I'm not sure why you want to use an array if you are just removing the first line. This would be better:
awk -v LAST="^$Last_Alert" '
BEGIN { flag=0 }
$0 ~ LAST,"" {
if (flag++) print
}' $LogFile

[VK2COT]

Hello,

Dennis' Awk solution is much simpler
and more portable.

My command works with GNU Awk 3.1.5 on
Fedora 8 server. I just checked it again.
No errors with length(arr). But,
most versions of Awk would probably
fail because of lenth(arr).

In any case, since simpler is better -
use Sed, Perl, or Dennis' version of Awk :)

I have no idea why I created such a
complex Awk solution. I guess being on
holidays, I had too much free
time and came up with this solution (I was
supposed to play tennis today but my
friend, who is a lecturer of Robotics,
cancelled). I tried my persuade my wife to
play tennis, but she hates sports so I
really had no choice but to make myself
occupied with Unix...

AHH, I am going back to teaching at HP
next week, so I am sure I will have less
free time them.

Cheers,

VK2COT