获取特定时间的/ var / log / messages

Question

我想查看特定时间的日志，即从10:00到13:00。

• OS：redhat 6
• 日志：/ var / log / messages
• 时间戳：11月10日10:00至13:00

我已经尝试过以下命令，但没有运气：

sed -n '/Nov  10 10:00:01/ , /Nov  10 13:30:09/p' /var/log/messages

Answer 1

您可以使用awk轻松完成：

[root@test httpd]# cat /var/log/messages |awk '$0>="Nov 11 00:26:00" && $0<="Nov 11 00:28:00"'
Nov 11 00:26:15 test named[3224]: REFUSED unexpected RCODE resolving '30.145.232.49.in-addr.arpa/PTR/IN': 58.129.247.39#53
Nov 11 00:26:16 test named[3224]: REFUSED unexpected RCODE resolving '30.145.232.49.in-addr.arpa/PTR/IN': 211.153.19.1#53
Nov 11 00:26:16 test named[3224]: REFUSED unexpected RCODE resolving '30.145.232.49.in-addr.arpa/PTR/IN': 58.129.247.39#53
Nov 11 00:26:16 test named[3224]: REFUSED unexpected RCODE resolving '30.145.232.49.in-addr.arpa/PTR/IN': 211.153.19.1#53
Nov 11 00:26:36 test script.sh: sending incremental file list
Nov 11 00:26:36 test script.sh: trace-2019-11-11-00-25-16-1573424716.pcap
Nov 11 00:26:38 test script.sh: sent 6,979,522 bytes  received 43 bytes  1,994,161.43 bytes/sec
Nov 11 00:26:38 test script.sh: total size is 6,977,686  speedup is 1.00
Nov 11 00:27:39 test script.sh: sending incremental file list
Nov 11 00:27:39 test script.sh: trace-2019-11-11-00-26-16-1573424776.pcap
Nov 11 00:27:41 test script.sh: sent 6,817,012 bytes  received 43 bytes  2,726,822.00 bytes/sec
Nov 11 00:27:41 test script.sh: total size is 6,815,216  speedup is 1.00
[root@test httpd]#