Grep log file for numbers above 50

[Rees]

I'm wanting to list the lines in the log file which contain a set of numbers surrounded by spaces where the number is larger than 50. Regular expressions seem to get me lost everytime I attempt to use them, but i'm sure this is an easy one for someone

tail -f -n1000 /logfile | grep " [5-9][0-9] "

[Mittineague]

I'm not familliar with command line syntax, but that looks like it will get 50 to 99 when there are spaces on both sides.
That what you want? i.e. not "greater than 50" but 50 included, and only up to 99?

[dsheroh]

I'm wanting to list the lines in the log file which contain a set of numbers surrounded by spaces where the number is larger than 50. Regular expressions seem to get me lost everytime I attempt to use them, but i'm sure this is an easy one for someone

tail -f -n1000 /logfile | grep " [5-9][0-9] "

Given your statement of what you're looking for, that's pretty much what I'd try first. Have you tried it already? If it doesn't work correctly, in what way do the results differ from your desired results (ideally including a few lines of sample input, the actual output, and the desired output)?

[LesleyB]

Hi Rees

I'm no regexp expert but I want to run some points by you.

The -f option on tail will follow the file so the command will stay going and output any change to the file.
The -n option specifies the last lines you want to read from the file,

so your tail -f n1000 <file> dumps the last 1000 lines out to screen and follows the file from then on.

The output gets piped to the grep command. At best your grep command is going to try to match a two digit number between from 50 to 99.
Is this what you want or are your numbers ever > 99 ?

As a simple test of your regexp, I created this data file called data

50
99
100
32
1
5
9
66
75

and got these results using cat instead of tail

cat data | grep " [5-9][0-9] "
50
99
66
75

So the regexp does pick up two digit numbers, ignoring single and 3 digit numbers and two digit numbers < 50 .

A modified form of your command :

tail -f -n 1000 /var/log/messages | grep ":[3-5][0-9]:"

also seems to work well on my system

[Rees]

Thank you for your replies, I may of not explained it as well as I could of.

I'm wanting to grep for any number larger than 50 wrapped around spaces. So for example:

2011-10-05T10:28:53+00:00 DEBUG (7): one page SAGEPAY) order taking 60 seconds to save, Order ID: 20072
2011-10-05T10:28:53+00:00 DEBUG (7): one page SAGEPAY) order taking 90 seconds to save, Order ID: 20073

This is all working correctly using this command:

tail -f -n1000 /logfile | grep " [5-9][0-9] "

The trouble is when I want to grep for numbers that are larger then 99:

2011-10-05T10:28:53+00:00 DEBUG (7): one page SAGEPAY) order taking 198 seconds to save, Order ID: 20073

I think LesleyB isnt far off the solution. Its finding the numbers but numbers below 50.

Hope this makes sense.

[Mittineague]

Not tested, but maybe
" ([5-9][0-9]|[1-9][0-9][0-9]+) "
for 50 inclusive on up.
If you know you won't go over 999 you could leave out the "+"

[Rees]

It doesn't show up anything with:

" ([5-9][0-9]|[1-9][0-9][0-9]+) "

Iv'e tried changing it around also but doesnt seem to work.

[dsheroh]

It doesn't show up anything with:

" ([5-9][0-9]|[1-9][0-9][0-9]+) "

Iv'e tried changing it around also but doesnt seem to work.

Yeah, it's a precedence issue... That's being parsed as "[5-9], then either [0-9] or [1-9], then two or more [0-9]s", so it only matches numbers 5000 or higher.

Try " ([5-9][0-9])|([1-9][0-9][0-9]+) " instead to get things grouped correctly. If you're using the contents of the match (rather than just checking whether a match exists), you'll probably want to add another set of parentheses around the whole thing so that you only need to look in one place to find the match result instead of two places.

Also note that if you're entering these on the command line, you may (depending on how exactly you arrange your grep command) need to escape the parentheses, pipe character, and plus sign, making the pattern " \([5-9][0-9]\)\|\([1-9][0-9][0-9]\+\) ".

[Rees]

Thank you very much all. I have got it working with dsheroh post, looks like the main issue was escaping the characters.

tail -f -n1000 /var/messages| grep " \(\([5-9][0-9]\)\|\([0-9][0-9][0-9]\+\)\) "

Thanks again.