1

I have a log file in this format:

2016-01-21 01:56:48,586 [http-nio-8320-exec-54] INFO  config.web.login  - Successful login. Username: XYZ, xxxxx

How do I grep this file and get only the lines where the time is between 1:50:00 and 1:56:00 and where the string config.web.login - Successful login. Username: XYZ is present? I'm trying to count the number of successful logins for a certain username.

3 Answers 3

2

You can do this with the help of awk and grep.

Try this code:

awk '/01:50:48/, /01:56:48/' <<FILENAME>> | grep 'Successful login. Username: XYZ,\s\+xxxxx'

Where /01:50:00/ is the start time and /01:56:00/ the stop time. Replace << FILENAME>> with the path to your log file.

0

If anybody wants to get the logs within the particular time rage, maybe you want to get the logs within 5 min you can do like the below

For dynamic time range (eg you dont know the time range but needs logs between last 5 min)

#!/bin/bash
LOG_FILE="./modsec.txt"
SEARCH_WORD="ModSecurity: Access denied"
START_TIME=$(date -d "5 minutes ago" "+%H:%M")
END_TIME=$(date "+%H:%M")

# using sed
sed -n "/"$START_TIME"/,/"$CURRENT_TIME"/p" "$LOG_FILE" | grep -w "$SEARCH_WORD"

For static time range (you know the time range)

sed -n "/hh:mm/,/hh:mm/p" "$LOG_FILE" | grep -w "$SEARCH_WORD" (you can replace the time range based on your timestamp)

1
  • What question are you answering?
    – Toto
    Sep 9, 2023 at 12:11
0

I am assuming that you are interested in the 01:50:00 to 01:56:00 time frame on only the date 2016-01-21 that is shown in your example.

Here's a solution using only grep:

$ egrep '^2016-01-21 01:(56:00|5[0-5]:[0-5][0-9]).*[[:blank:]]config.web.login  - Successful login. Username: XYZ,'
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .