Re: [gentoo-user] Potential Supid question re Grep

[Richard Fish <bigfish@asmallpond.org>]

Michael Thompson wrote:

>I am trying to extract information in my logs for a abuse department and am 
>using the code:
>
>Code:
>
>zcat /var/log/messages.*?.gz | grep 212.56.68.108 >> /home/mike/abuse1
>
>The logs are standard: messages.??.gz
>
>However, when I examine the output, it starts on the 1st may, however the logs 
>contain details from the 25th Febuary. What am I doing wrong?
>
>  
>

Are you *sure* the February information is not there??  I think this
probably has nothing to do with the grep command, but more with the
shell expansion.  When I do "ls -l /var/log/messages.*?.gz", I get the
following:

-rw-------  1 root root 696588 Feb 21 09:00 /var/log/messages.1.gz
-rw-------  1 root root 795675 Feb 14 15:40 /var/log/messages.2.gz
-rw-------  1 root root 491964 Feb  6 19:00 /var/log/messages.3.gz
-rw-------  1 root root 482189 Jan 31 05:10 /var/log/messages.4.gz

Notice that the dates are in reverse order.  If I were to cat those
together, the oldest information would be at the end.  I think you want:

zcat `ls -rt /var/log/messages.*?.gz` | grep 212.56.68.108 >>
/home/mike/abuse1

-Richard

-- 
gentoo-user@gentoo.org mailing list