First perlmonks post.
If you have very large log files or slow disk, or both...
As long as the log file is ordered by datetime, you can use
Search::Dict's binary search to find entries for datetimes.
(this code has not been extensively tested)
#! perl -W
use strict;
use warnings;
# Yes, I know it's big and slow, room for improvment here
use Date::Manip;
use Search::Dict;
# The log file must be ordered by date for this to work.
# Use it like this:
# search_log /var/log/httpd/access_log "2008052205:32:43"
# or
# search_log /var/log/httpd/access_log "2008052205:32:4"
# search_log /var/log/httpd/access_log "2008052205:32:"
# search_log /var/log/httpd/access_log "2008052205:32"
# search_log /var/log/httpd/access_log "2008052205:3"
my $file = shift or die 'no file';
my $search_date = shift or die 'no search date in YYYYMMDDHH::MM::SS f
+ormat';
open my $fh,'<',$file or die $!;
sub get_date{
my($line) = @_;
my($d) = $line=~/\[(.*)\]/mxo or die "Can't find [date] in line: $
+line";
return ParseDate($d) or die "Can't parse date: $d";
}
my $pos = look $fh,$search_date,{
xfrm=>*get_date,
};
if(-1 == $pos){
die "Error looking for '$search_date' in file '$file': $!\n";
}
while(my $line=<$fh>){
if(get_date($line) =~m/$search_date/mxo){
print $line;
} else {
last;
}
}
-
Are you posting in the right place? Check out Where do I post X? to know for sure.
-
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big>
<blockquote> <br /> <dd>
<dl> <dt> <em> <font>
<h1> <h2> <h3> <h4>
<h5> <h6> <hr /> <i>
<li> <nbsp> <ol> <p>
<small> <strike> <strong>
<sub> <sup> <table>
<td> <th> <tr> <tt>
<u> <ul>
-
Snippets of code should be wrapped in
<code> tags not
<pre> tags. In fact, <pre>
tags should generally be avoided. If they must
be used, extreme care should be
taken to ensure that their contents do not
have long lines (<70 chars), in order to prevent
horizontal scrolling (and possible janitor
intervention).
-
Want more info? How to link
or How to display code and escape characters
are good places to start.
|