Since I want to specify in HH: MM: SS notation, use sed to make the time part independent. By the way, the port number at the end of the IP is also omitted. By specifying the start time and end time in HH: MM: SS, the status code will be changed within the specified time. It is possible to extract the line that is the error code.
qiita.rb
sed -r -e\ 's/(:[0-9]{4,5}|\/202[0-9]:)/ /'{,} /var/log/apache2/20200715/access_log | awk '"HH:MM:SS" <=$5&&$5<= "HH:MM:SS" {if($10>=400&&$10<=599)print $0}'
When I actually used it, it worked as expected, but it was quite troublesome to edit the time. So, is it possible to display one hour before the current time without bothering to edit it? As a result of thinking, I decided to use date and let awk define variables.
qiita.rb
sed -r -e\ 's/(:[0-9]{4,5}|\/202[0-9]:)/ /'{,} /var/log/apache2/20200715/access_log | awk -va=`date -d "60 minute ago" +%H:%M:%S` -vb=`date +%H:%M:%S` '{if($5>a&&$5<b&&$10>=400&&$10<=599)print $0}'
If you want to reduce the output to some extent, specify the part to print.
Recommended Posts