$ tac /var/log/rsync.log | perl -lane 'if(/received/){ print "$F[0] $F[1]"; exit }' # Update 2017-04-21: compacting that a little bit: $ tac /var/log/rsync.log | perl -lane 'if(/received/){print"@F[0,1]";exit}' #### use warnings; use strict; use File::ReadBackwards; die "Usage: $0 LOGFILE\n" unless @ARGV==1; my $FILE = shift @ARGV; my $bw = File::ReadBackwards->new($FILE) or die "Can't read $FILE: $!" ; LINE: while(defined( my $line = $bw->readline )) { chomp($line); if ( $line =~ /received/ ) { my ($dt) = $line =~ /^([\d\/]+\s+[\d\:]+)\b/ or die "Failed to parse date from: $line\n"; print "$dt\n"; last LINE; } } $bw->close; #### $ perl -lane '/received/ and $a="$F[0] $F[1]"}{print $a' /var/log/rsync.log