1

I have a text file with a bunch of ls -l output, such as:

-rw-r--r-- 1 root root 7554952082 Dec 15 22:11 /var/spool/stuff/Investigation/messages.tgz
-rw-r--r-- 1 root root 4315 Mar  3  2015 /var/spool/stuff/redoneagain.tgz
-rw-r--r-- 1 root root 429786 Apr 22  2014 /var/spool/stuff/random20.tgz

I can't run a new ls command because some of the files don't exist anymore.

What can I do to sort these files by those tragic human-readable dates? They're not alphabetical, and some of them don't even display the year information.

Edit Here's a larger sample set with fake file names:

-rw-r--r-- 1 root root 67746 Feb 23 2015 /fake/file/1
-rw-r--r-- 1 root root 665081504 Nov 10 22:26 /fake/file/2
-rw-r--r-- 1 root root 2268687431 Sep 11 2015 /fake/file/3
-rw-r--r-- 1 root root 2322223712 Sep 14 2015 /fake/file/4
-rw-r--r-- 1 root root 67413 Feb 25 2015 /fake/file/5
-rw-r--r-- 1 root root 193782 Oct 28 2013 /fake/file/6
-rw-r--r-- 1 root root 79802627 Nov 23 23:19 /fake/file/7
-rw-r--r-- 1 root root 53336532 Nov 23 23:20 /fake/file/8
-rw-r--r-- 1 root root 99797 Nov 10 00:27 /fake/file/9
-rw-r--r-- 1 root root 19618 Apr 17 2014 /fake/file/10
-rw-r--r-- 1 root root 1856 Oct 18 2013 /fake/file/11
-rw-r--r-- 1 root root 90213 Sep 23 2015 /fake/file/12
-rw-r--r-- 1 root root 1924 Sep 24 2015 /fake/file/13
-rw-r--r-- 1 root root 563907311 Nov 16 17:37 /fake/file/14
-rw-r--r-- 1 root root 193855 Oct 22 2013 /fake/file/15
-rw-r--r-- 1 root root 7554952082 Dec 15 22:11 /fake/file/16
-rw-r--r-- 1 root root 4315 Mar 3 2015 /fake/file/17
-rw-r--r-- 1 root root 429786 Apr 22 2014 /fake/file/18
-rw-r--r-- 1 root root 4870 Apr 18 2014 /fake/file/19
-rw-r--r-- 1 root root 87392 Feb 3 2015 /fake/file/20
-rw-r--r-- 1 root root 552396373 Dec 21 21:25 /fake/file/21
-rw-r--r-- 1 root root 3959214957 Aug 1 2015 /fake/file/22
-rw-r--r-- 1 root root 4678389972 Jul 31 2015 /fake/file/23
-rw-r--r-- 1 root root 5371125 Aug 27 2015 /fake/file/24
-rw-r--r-- 1 root root 2523669282 Jul 24 2015 /fake/file/25
-rw-r--r-- 1 root root 2138312957 Jul 27 2015 /fake/file/26
-rw-r--r-- 1 root root 87953 Feb 20 2015 /fake/file/27
-rw-r--r-- 1 root root 480600954 Nov 17 17:59 /fake/file/28
-rw-r--r-- 1 root root 1009402595 Oct 21 2014 /fake/file/29
-rw-r--r-- 1 root root 14991 Apr 15 2014 /fake/file/30
-rw-r--r-- 1 root root 5993812 Apr 16 2015 /fake/file/31
-rw-r--r-- 1 root root 4278 Feb 27 2015 /fake/file/32
-rw-r--r-- 1 root root 4141 Oct 18 2013 /fake/file/33
-rw-r--r-- 1 root root 8483609907 Aug 21 2015 /fake/file/34
-rw-r--r-- 1 root root 8509124532 Sep 15 2015 /fake/file/35
-rw-r--r-- 1 root root 4232 Dec 11 2014 /fake/file/36
-rw-r--r-- 1 root root 8462334652 Apr 9 2015 /fake/file/37
-rw-r--r-- 1 root root 441345893 Apr 9 2015 /fake/file/38
-rw-r--r-- 1 root root 144456171297 Jun 12 2015 /fake/file/39
-rw-r--r-- 1 root root 223299330621 Jun 3 2015 /fake/file/40
-rw-r--r-- 1 root root 1116344491 Nov 11 22:28 /fake/file/41
-rw-r--r-- 1 root root 15265 Apr 15 2014 /fake/file/42
2
  • can you post a larger sample to test against? – Baroudi Safwen Apr 4 '16 at 18:07
  • Are you open to manipulating the data from your log in some interface other than the terminal? Seems like something that could be easily/quickly resolved in Excel by importing data delimited by space characters. You could then automate this process to apply against other logs. You still will not be able to accommodate for the missing years. – root Apr 4 '16 at 20:42
2

datesort from the dateutils package can do it:

$ datesort -i '%b %d %Y' -i '%b %d %H:%M' < FILE

The trick is to use two input formats because ls, for recent dates, omits the year and shows the time instead.

Disclaimer: I am the author of the tool.

0

You don't have to avoid ls just because the ugly (it really is) time displaying:

-c with -lt: sort by, and show, ctime (time of last modification of file status information) with -l: show ctime and sort by name otherwise: sort by ctime, newest first

2
  • 1
    he said he can't use ls because some files don't exist anymore ! – Baroudi Safwen Apr 4 '16 at 18:06
  • Indeed. I didn't decode this part right. – Gombai Sándor Apr 4 '16 at 18:26
0

You could write some little script that parses the date strings and then sorts by date. Some of the date strings do not actually say which year, so I would think that "closest occurrence before the input file was written" is a sensible guess.

Quickly thrown together proof of concept:

#!/usr/bin/perl
use strict;
use Time::ParseDate;

sub extracttimestamp
{
        my $line = shift;
        my $referencepoint = shift;

        if ($line =~ /^(?:\S+\s+){5}(\S+\s+\S+\s+\S+)\s+/)
        {
                return parsedate($1, NOW => $referencepoint, PREFER_PAST => 1);
        }

        print "FAILED TO PARSE $line\n";
        return -1;
}

my $filename = $ARGV[0];
my $mtime = (stat($filename))[9];

open FILE, "<$filename";
my @list = <FILE>;
close FILE;

my @sorted = sort { extracttimestamp($a, $mtime) <=> extracttimestamp($b, $mtime) } @list;

foreach my $x (@sorted)
{
        print $x;
}
3
  • I can't modify the perl installation on the target box, but the above gives "Can't locate Time/ParseDate.pm in @INC". I'm not against scripts, I just don't know which ones have libraries which might parse that date format and don't seem to have the prerequisites to run that specific script. – Hammer Bro. Apr 4 '16 at 19:38
  • @HammerBro. And you can't install the module in a local directory or run the script on a machine where you can make changes? – Håkan Lindqvist Apr 4 '16 at 19:48
  • I'd have to go through some change management systems which have pretty slow turnaround and I expect I'll have to do this same operation on numerous different machines once I get a little further in my investigation. – Hammer Bro. Apr 4 '16 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.