bash 从特定行号拖尾日志文件

tail a log file from a specific line number

提问by Molenpad

I know how to tail a text file with a specific number of lines,

我知道如何使用特定行数拖尾文本文件，

tail -n50 /this/is/my.log

However, how do I make that line count a variable?

但是，如何使该行计数成为变量？

Let's say I have a large log file which is appended to daily by some program, all lines in the log file start with a datetime in this format:

假设我有一个大型日志文件，它由某个程序每天附加到，日志文件中的所有行都以这种格式的日期时间开头：

Day Mon YY HH:MM:SS

Every day I want to output the tail of the log file but only for the previous days records. Let's say this output runs just after midnight, I'm not worried about the tail spilling over into the next day.

每天我都想输出日志文件的尾部，但只输出前几天的记录。假设这个输出在午夜之后运行，我不担心尾部会溢出到第二天。

I just want to be able to work out how many rows to tail, based on the first occurrence of yesterdays date...

我只是希望能够根据昨天日期的第一次出现来计算出要拖尾的行数...

Is that possible?

那可能吗？

回答by Gem Taylor

Answering the question of the title, for anyone who comes here that way, head and tail can both accept a code for how much of the file to exclude.

回答标题的问题，对于以这种方式来到这里的任何人，head 和 tail 都可以接受一个代码来排除多少文件。

• For tail, use -n +numfor the line number numto start at
• For head, use -n -numfor the number of lines not to print

• 对于尾部，-n +num用于行号num开始于
• 对于 head，-n -num用于不打印的行数

This is relevant to the actual question if you have remembered the number of lines from the previous time you did the command, and then used that number for tail -n +$prevlinesto get the next portion of the partial log, regardless of how often the log is checked.

如果您记得上次执行命令时的行数，然后使用该数字tail -n +$prevlines获取部分日志的下一部分，无论日志检查的频率如何，这与实际问题相关。

Answering the actual question, one way to print everything after a certain line that you can grep is to use the -A option with a ridiculous count. This may be more useful than the other answers here as you can get a number of days of results. So to get everything from yesterday and so-far today:

回答实际问题，在可以 grep 的特定行之后打印所有内容的一种方法是使用 -A 选项和可笑的计数。这可能比这里的其他答案更有用，因为您可以获得几天的结果。因此，要获取昨天和今天的所有内容：

grep "^`date -d yesterday '+%d %b %y'`" -A1000000 log_file.txt

You can combine 2 greps to print between 2 date ranges.

您可以组合 2 个 grep 以在 2 个日期范围之间打印。

Note that this relies on the date actually occurring in the log file. It has the weakness that if no events were logged on a particular day used as the range marker, then it will fail to find anything.

请注意，这取决于日志文件中实际发生的日期。它的弱点是如果在用作范围标记的特定日期没有记录任何事件，那么它将无法找到任何内容。

To resolve that you could inject dummy records for the start and end dates and sort the file before grepping. This is probably overkill, though, and the sort may be expensive, so I won't example it.

要解决这个问题，您可以为开始和结束日期注入虚拟记录，并在 grepping 之前对文件进行排序。不过，这可能有点矫枉过正，而且这种方式可能很昂贵，所以我不会举例说明。

回答by sheltond

I don't think tail has any functionality like this.

我不认为 tail 有任何这样的功能。

You could work out the beginning and ending line numbers using awk, but if you just want to exact those lines from the log file, the simplest way is probably to use grep combined with date to do it. Matching yesterday's date at beginning of line should work:

您可以使用 awk 计算出开始和结束的行号，但如果您只想从日志文件中精确地确定这些行，最简单的方法可能是使用 grep 和 date 相结合来完成。在行首匹配昨天的日期应该有效：

grep "^`date -d yesterday '+%d %b %y'`" < log_file.txt

You may need to adjust the date format to match exactly what you've got in the log file.

您可能需要调整日期格式以与日志文件中的内容完全匹配。

回答by Molenpad

I worked this out through trial and error by getting the line numbers for the first line containing the date and the total lines, as follows:

我通过反复试验得到包含日期和总行数的第一行的行号，如下所示：

lines=$(wc -l < myfile.log)

start=$(cat myfile.log | grep -no $datestring | head -n1 | cut -f1 -d:)

n=$((lines-start))

and then a tail, based on that:

然后是尾巴，基于此：

tail -n$n myfile.log

回答by Vladimir.V.Bvn

You can do it without tail, just grep rows with previous date:

你可以不加尾就完成，只需用上一个日期 grep 行：

cat my.log | grep "$( date -d "yesterday 13:00" '+%d %m %Y')"

猫我的日志| grep "$( date -d "昨天 13:00" '+%d %m %Y')"

And if you need line count you can add | wc -l

如果您需要行数，您可以添加 | wc -l