grep在两个时间戳之间的日志

Question

2021-02-10 08:17:38 dell AptDaemon.Worker: INFO: Processing transaction /org/debian/apt/transaction/08a244f7b8ce4fad9f6b304aca9eae7a
2021-02-10 08:17:50 dell AptDaemon.Worker: INFO: Finished transaction /org/debian/apt/transaction/08a244f7b8ce4fad9f6b304aca9eae7a
2021-02-10 08:18:50 dell AptDaemon.PackageKit: INFO: Initializing PackageKit transaction
2021-02-10 08:18:50 dell AptDaemon.Worker: INFO: Simulating trans: /org/debian/apt/transaction/37c3ef54a6ba4933a561c49b3fac5f6e
2021-02-10 08:18:50 dell AptDaemon.Worker: INFO: Processing transaction /org/debian/apt/transaction/37c3ef54a6ba4933a561c49b3fac5f6e
2021-02-10 08:18:51 dell AptDaemon.PackageKit: INFO: Get updates()
2021-02-10 08:18:52 dell AptDaemon.Worker: INFO: Finished transaction /org/debian/apt/transaction/37c3ef54a6ba4933a561c49b3fac5f6e
2021-02-10 08:24:36 dell AptDaemon: INFO: Quitting due to inactivity
2021-02-10 10:17:38 dell AptDaemon.Worker: INFO: Processing transaction /org/debian/apt/transaction/08a244f7b8ce4fad9f6b304aca9eae7a
2021-02-10 10:17:50 dell AptDaemon.Worker: INFO: Finished transaction /org/debian/apt/transaction/08a244f7b8ce4fad9f6b304aca9eae7a
2021-02-10 10:18:50 dell AptDaemon.PackageKit: INFO: Initializing PackageKit transaction
2021-02-10 10:18:50 dell AptDaemon.Worker: INFO: Simulating trans: /org/debian/apt/transaction/37c3ef54a6ba4933a561c49b3fac5f6e
2021-02-10 10:18:50 dell AptDaemon.Worker: INFO: Processing transaction /org/debian/apt/transaction/37c3ef54a6ba4933a561c49b3fac5f6e
2021-02-10 10:18:51 dell AptDaemon.PackageKit: INFO: Get updates()
2021-02-10 10:18:52 dell AptDaemon.Worker: INFO: Finished transaction /org/debian/apt/transaction/37c3ef54a6ba4933a561c49b3fac5f6e
2021-02-10 10:24:36 dell AptDaemon: INFO: Quitting due to inactivity

希望在2021-02-1008:00和2021-02-1009:00之间使用grep日志。

 sudo sed -n '/2021-02-10 08:00:00/,/2021-02-10 09:00:00/p' /var/log/app.log

此命令不打印任何输出。就好像我使用了精确的时间戳，那么它就是打印输出。例如，如果我使用下面的命令打印输出

sudo sed -n '/2021-02-10 08:17:38/,/2021-02-10 08:24:36/p' /var/log/app.log

如果日志文件不包含起始时间戳和结束时间戳，而是包含时间戳之间的日志，请建议如何在时间戳之间使用sed命令。

Answer 1

构造sed '/start-date/,/end-date/'并不是定义范围；它只会从包含“开始日期”的行开始，到包含“结束日期”的第一行，而不是日期范围。

使用sed如下：

sed -E '/2021-02-10 (08:[0-5][0-9]:[0-5][0-9]|09:00:00)/!d' /log/infile

grep也是如此：

grep -E '2021-02-10 (08:[0-5][0-9]:[0-5][0-9]|09:00:00)' /log/infile

或者使用awk：

awk '/2021-02-10 (08:[0-5][0-9]:[0-5][0-9]|09:00:00)/' /log/infile

特别适合你的需要。

使用awk作为正确处理日期范围的解决方案，并调用外部命令GNU进行从人读到时代的日期会话：

awk -v start='2021-02-10 08:00:00' -v end='2021-02-10 08:24:36' -v q="'" '
BEGIN{
    st="date -d" q start q " +%s"; st |getline start; close(st);
    ed="date -d" q end   q " +%s"; ed |getline end;   close(ed)
}
{ dt=$1" "$2; epoch="date -d" q dt q " +%s"; epoch |getline dt; close(epoch) };
(dt>=start && dt<=end)' infile

或者使用GNU代替使用mktime()函数来处理日期：

awk -v start='2021-02-10 08:00:00' -v end='2021-02-10 08:24:36' '
 BEGIN{ gsub(/[:-]/," ", start); gsub(/[:-]/," ", end) }
      { dt=$1" "$2; gsub(/[:-]/," ", dt) }
 mktime(dt)>=mktime(start) && mktime(dt)<=mktime(end)' infile

请注意，我们将所有冒号和空格替换为mktime()，接受YYYY MM DD HH MM SS__格式的时间。