Solaris Convert Get Last Hour of Logs by Comparing the Timestamps

Question

I have a log that looks like this:

####<Sep 16, 2014 6:12:45 PM EST> <Notice> <StdErr> <myserver> <myinstance> <[ACTIVE] ExecuteThread: '17' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1410913515898> <BEA-000000> <at weblogic.rmi.internal.BasicServerRef$1.run(BasicServerRef.java:522)>
####<Sep 16, 2014 9:45:08 PM EST> <Notice> <StdErr> <myserver> <myinstance> <[ACTIVE] ExecuteThread: '17' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1410913515898> <BEA-000000> <at weblogic.rmi.internal.BasicServerRef$1.run(BasicServerRef.java:522)>
####<Sep 16, 2014 10:27:26 PM EST> <Notice> <StdErr> <myserver> <myinstance> <[ACTIVE] ExecuteThread: '17' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1410913515898> <BEA-000000> <at weblogic.rmi.internal.BasicServerRef$1.run(BasicServerRef.java:522)>
####<Sep 16, 2014 11:25:16 PM EST> <Notice> <StdErr> <myserver> <myinstance> <[ACTIVE] ExecuteThread: '17' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1410913515898> <BEA-000000> <at weblogic.rmi.internal.BasicServerRef$1.run(BasicServerRef.java:522)>

Let's say the time is currently 11:26 PM EST. I only want to get entries written in the last hour. I've previously used something like this:

nawk -F "<" -v MyDate=`TZ=MYT+6 date "+%b %d, %Y%l:%M:%S %Z"` ' {if ($2 > MyDate) print $2}'

but i'm getting the following error when attempting to run this:

nawk: syntax error at source line 1
  context is
     >>> 16, <<<
nawk: bailing out at source line 1

How can I list the entries that were written in the last hour using the Solaris tools (NOT GNU)?

shellter · Accepted Answer · 2014-09-17T02:12:14.307

set -vx will set you free ;-)

When I execute

 print -- "####<Sep 16, 2014 11:25:16 PM EST> <Notice> <StdErr> <myserver> " \
 | awk -F "<" -v MyDate=`TZ=MYT+6 date "+%b %d, %Y%l:%M:%S %Z"` ' {if ($2 > MyDate) print $2}'

(I use ksh, and its print function is very handy, you can usually substitute echo for print in these sort of cases).

I get a very similar err msg

awk: syntax error at source line 1
 context is
         >>>  <<<
awk: bailing out at source line 1

When I issue the set -vx, I can see what is going to be executed AND what is being substituted for environment variables. Which shows me

1>awk -F '<' -v MyDate=Sep 16, 2014Sep 16 19:59:59:12 MYT ' {if ($2 > MyDate) print $2}'

Notice how 'Sep 16' is repeated?

I can do man date on my system, or as that can be problematic, I try each of the % args that I don't recognize and quickly find that for my version of date,

 date +%l
Sep 16 20:00

AND of course, the debug output shows me that I probably want to dbl-quote my input for the variable to awk, hence,

 awk -F "<" -v MyDate="`TZ=MYT+6 date '+%b %d, %Y:%M:%S %Z'`" ' {if ($2 > MyDate) print $2}'

should definitely be closer. If you this doesn't fix it, then I'll set up a more detailed test.

Finally, I'd comment that I'm surprized that comparisons containing mixed format (Sep/MYT) date values work as you need, but I suppose translating Sep 16, 2014 11:25:16 PM EST into 201409162325165 is a bit of a headache.

P.S. Also using back-ticks for command substitution was branded as deprecated in the 'Kornshell programming language' published in 1995. Join the 90s and use $( ... cmd ...) command-substitution ;-)

IHTH

Nice, I was on pins and needles waiting for your final answer :) Works great, though I had to use nawk in Solaris. Thanks! — Ken J, Sep 17 '14 at 02:15
yep, `nawk` definitely is the way to go. Ironically, `awk` on Solaris's (seemingly) only error message is very similar to what I have included above. Glad that helped! — shellter, Sep 17 '14 at 02:18
LOL, me too. I'm throwing out my C programming books/mags this week, Nextstep stuff too, do you want them? — shellter, Sep 19 '14 at 22:55

Solaris Convert Get Last Hour of Logs by Comparing the Timestamps

1 Answers1