0

I want to write a bash script that will find number of occurrence of a string from last ten minutes logs. i used a while loop but it is too slow to run as it is increasing each second. i want a simple sed or grep command that should be replaced by loop and should work efficiently.

#!/bin/bash
log_file="logfile.log"
search_string="your_search_string"
COUNTER=0
current_time=$(date +%s)
start_time=$((current_time-600))
    while [ $start_time -le $current_time ]
    do
        
        date_time=$(date -d @$start_time +"%Y-%m-%d %H:%M:%S")
        count=$(grep "$date_time" "$log_file" | grep "$search_string" | wc -l)
            if [ $count -eq 1 ]; then
                COUNTER=$[$COUNTER +1]
                return
            fi
        echo "$date_time: $COUNTER occurrences"
        start_time=$((start_time+1))
    done
 echo "$COUNTER occurrences"

My log file timestamp looks like:

INFO  \[RMI TCP Connection(4)-10.103.5.24\] 2022-11-29 15:21:01,552 Server.java:225 - Stop listening
WARN  \[RMI TCP Connection(6)-10.103.5.24\] 2022-11-29 15:21:07,948 StorageService.java:359 - Stopping gossip
INFO  \[RMI TCP Connection(6)-10.103.5.24\] 2022-11-29 15:21:07,949 Gossiper.java:1456 - Announcing shutdown

I want to change the do while loop with some sed or grep command

Gilles Quénot
  • 173,512
  • 41
  • 224
  • 223
  • [Counting lines or enumerating line numbers so I can loop over them - why is this an anti-pattern?](https://stackoverflow.com/questions/65538947/counting-lines-or-enumerating-line-numbers-so-i-can-loop-over-them-why-is-this) – tripleee Feb 17 '23 at 08:37
  • A better solution is to create a regex for the lines you want to match and then just count them. This is a one-liner in Awk. – tripleee Feb 17 '23 at 08:38
  • Can you please share it here? thanks – Junaid Khan Feb 17 '23 at 09:33
  • `perl -MTime::Piece -ne 'my $t = localtime; my $now = $t->epoch; m/\s+(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}),/;my $d = Time::Piece->strptime($1, "%Y-%m-%d %H:%M:%S"); my $old = $d->strftime("%s"); if ((($now - $old)+25200) <= 600) {print}' file` related: https://stackoverflow.com/a/75483421/465183 – Gilles Quénot Feb 17 '23 at 11:30
  • https://hastebin.com/share/ayuyozihup.swift – Gilles Quénot Feb 17 '23 at 11:32
  • Big up to @triplee, I was just a few seconds to give a nice answer before you decide that's a (not real) duplicate – Gilles Quénot Feb 17 '23 at 12:46

0 Answers0