$ tac /var/log/rsync.log | perl -lane 'if(/received/){ print "$F[0] $F
+[1]"; exit }'
# Update 2017-04-21: compacting that a little bit:
$ tac /var/log/rsync.log | perl -lane 'if(/received/){print"@F[0,1]";e
+xit}'
Script (using File::ReadBackwards):
use warnings;
use strict;
use File::ReadBackwards;
die "Usage: $0 LOGFILE\n" unless @ARGV==1;
my $FILE = shift @ARGV;
my $bw = File::ReadBackwards->new($FILE)
or die "Can't read $FILE: $!" ;
LINE: while(defined( my $line = $bw->readline )) {
chomp($line);
if ( $line =~ /received/ ) {
my ($dt) = $line =~ /^([\d\/]+\s+[\d\:]+)\b/
or die "Failed to parse date from: $line\n";
print "$dt\n";
last LINE;
}
}
$bw->close;
Update: Credit to Discipulus for the inspiration of the first one-liner. Here's another one that scans the file forwards, like your original code does, but of course it'll be less efficient on larger files. For an explanation of }{ see the "Eskimo greeting" in perlsecret.
$ perl -lane '/received/ and $a="$F[0] $F[1]"}{print $a' /var/log/rsyn
+c.log
