Bash – extract information from a log file

bashshellunix

I wrote a bash script to extract a few Items like the IP addresses that makes the most number of connection attempts, now I want to limit all of this within a time range , lets say the last 5 days/hours.

Example of what I wrote :

-G: Which IP address makes the most number of connection attempts?

if [ "$3" = "-G" ]; then 
 I won't write the whole code ! 
echo "IP address makes the most number of connection attempts: \n"
awk '{print $1}' $4 | sort | uniq -c | sort -r -n | awk '{print $2 "\t" $1}' >> Connections 
cat Connections | head -$2 
 rm Connections

now I want to add this Items

-O: Limit it to last number of hours

-P: Limit it to the last number of days

and I run it like this : sh -O -P -G *.log

example log file:

213.46.27.204 - - [15/Sep/2011:22:55:21 +0100]
213.46.27.204 - - [16/Sep/2011:22:55:21 +0100]
213.46.27.204 - - [17/Sep/2011:22:55:21 +0100]
213.46.27.204 - - [18/Sep/2011:22:55:21 +0100]
213.46.27.204 - - [19/Sep/2011:22:55:21 +0100]

please answer just with bash script not python or perl


we have the last date in the log file and we want to extract the last 5 hour/day so :

I find this scrip that converted the date to unix recognizable format but since I have Mac OSX I could not run it 🙁 do know why ? )

#!/bin/env bash

  temp_date=`cat ./serverlog.log | tail -n1 \
  | cut -d [ -f 2 | cut -d ] -f 1`

  echo "$temp_date"

  temp_date2=`echo $temp_date | \
  sed -e 's/Jan/01/g' \
  -e 's/Feb/02/g' -e 's/Mar/03/g' \
  -e 's/Apr/04/g' -e 's/May/05/g' \
  -e 's/Jun/06/g' -e 's/Jul/07/g' \
  -e 's/Aug/08/g' -e 's/Sep/09/g' \
  -e 's/Oct/10/g' -e 's/Nov/11/g' \
  -e 's/Dec/12/g'`

  echo "$temp_date2"

  temp_year=`echo $temp_date2 | gawk '{print substr($0,7,4)}'`
  temp_month=`echo $temp_date2 | gawk '{print substr($0,4,2)}'`
  temp_day=`echo $temp_date2 | gawk '{print substr($0,1,2)}'`
  temp_time=`echo $temp_date2 | gawk '{print substr($0,12,8)}'`

  #UTC format
  utc_date="$temp_year-$temp_month-$temp_day $temp_time"

  echo "$utc_date"

  reference_seconds=`date --utc -d "$utc_date" +%s`

  echo "$reference_seconds"

I recognized that the last step would be to subtract 5 hours/days from the last date

lastdate(converted) – (5*3600) = X, now we can extract the last 5 hours from log file .
last date – ( 5 *24*3600 ) + X, now we can extract the last 5 days from the log file .

now any idea how to exactly write this?

Best Answer

There's a script here that will output the lines within a certain date range. Pipe the output to your program and that's it.

Related Topic