SitePoint Sponsor

User Tag List

Results 1 to 9 of 9
  1. #1
    SitePoint Enthusiast
    Join Date
    Jul 2004
    Location
    Shrewsbury
    Posts
    54
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)

    Question Grep log file for numbers above 50

    I'm wanting to list the lines in the log file which contain a set of numbers surrounded by spaces where the number is larger than 50. Regular expressions seem to get me lost everytime I attempt to use them, but i'm sure this is an easy one for someone

    Code:
    tail -f -n1000 /logfile | grep " [5-9][0-9] "

  2. #2
    Programming Team silver trophybronze trophy
    Mittineague's Avatar
    Join Date
    Jul 2005
    Location
    West Springfield, Massachusetts
    Posts
    16,448
    Mentioned
    160 Post(s)
    Tagged
    1 Thread(s)
    I'm not familliar with command line syntax, but that looks like it will get 50 to 99 when there are spaces on both sides.
    That what you want? i.e. not "greater than 50" but 50 included, and only up to 99?

  3. #3
    SitePoint Member
    Join Date
    Aug 2011
    Posts
    19
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Quote Originally Posted by Rees View Post
    I'm wanting to list the lines in the log file which contain a set of numbers surrounded by spaces where the number is larger than 50. Regular expressions seem to get me lost everytime I attempt to use them, but i'm sure this is an easy one for someone

    Code:
    tail -f -n1000 /logfile | grep " [5-9][0-9] "
    Given your statement of what you're looking for, that's pretty much what I'd try first. Have you tried it already? If it doesn't work correctly, in what way do the results differ from your desired results (ideally including a few lines of sample input, the actual output, and the desired output)?

  4. #4
    SitePoint Enthusiast
    Join Date
    Oct 2007
    Posts
    34
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Hi Rees

    I'm no regexp expert but I want to run some points by you.

    The -f option on tail will follow the file so the command will stay going and output any change to the file.
    The -n option specifies the last lines you want to read from the file,

    so your tail -f n1000 <file> dumps the last 1000 lines out to screen and follows the file from then on.

    The output gets piped to the grep command. At best your grep command is going to try to match a two digit number between from 50 to 99.
    Is this what you want or are your numbers ever > 99 ?

    As a simple test of your regexp, I created this data file called data

    50
    99
    100
    32
    1
    5
    9
    66
    75

    and got these results using cat instead of tail

    cat data | grep " [5-9][0-9] "
    50
    99
    66
    75

    So the regexp does pick up two digit numbers, ignoring single and 3 digit numbers and two digit numbers < 50 .

    A modified form of your command :

    tail -f -n 1000 /var/log/messages | grep ":[3-5][0-9]:"

    also seems to work well on my system

  5. #5
    SitePoint Enthusiast
    Join Date
    Jul 2004
    Location
    Shrewsbury
    Posts
    54
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)

    Question

    Thank you for your replies, I may of not explained it as well as I could of.

    I'm wanting to grep for any number larger than 50 wrapped around spaces. So for example:
    Code:
    2011-10-05T10:28:53+00:00 DEBUG (7): one page SAGEPAY) order taking 60 seconds to save, Order ID: 20072
    2011-10-05T10:28:53+00:00 DEBUG (7): one page SAGEPAY) order taking 90 seconds to save, Order ID: 20073
    This is all working correctly using this command:
    Code:
    tail -f -n1000 /logfile | grep " [5-9][0-9] "
    The trouble is when I want to grep for numbers that are larger then 99:
    Code:
    2011-10-05T10:28:53+00:00 DEBUG (7): one page SAGEPAY) order taking 198 seconds to save, Order ID: 20073
    I think LesleyB isnt far off the solution. Its finding the numbers but numbers below 50.

    Hope this makes sense.

  6. #6
    Programming Team silver trophybronze trophy
    Mittineague's Avatar
    Join Date
    Jul 2005
    Location
    West Springfield, Massachusetts
    Posts
    16,448
    Mentioned
    160 Post(s)
    Tagged
    1 Thread(s)
    Not tested, but maybe
    " ([5-9][0-9]|[1-9][0-9][0-9]+) "
    for 50 inclusive on up.
    If you know you won't go over 999 you could leave out the "+"

  7. #7
    SitePoint Enthusiast
    Join Date
    Jul 2004
    Location
    Shrewsbury
    Posts
    54
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)
    It doesn't show up anything with:
    Code:
    " ([5-9][0-9]|[1-9][0-9][0-9]+) "
    Iv'e tried changing it around also but doesnt seem to work.

  8. #8
    SitePoint Member
    Join Date
    Aug 2011
    Posts
    19
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Quote Originally Posted by Rees View Post
    It doesn't show up anything with:
    Code:
    " ([5-9][0-9]|[1-9][0-9][0-9]+) "
    Iv'e tried changing it around also but doesnt seem to work.
    Yeah, it's a precedence issue... That's being parsed as "[5-9], then either [0-9] or [1-9], then two or more [0-9]s", so it only matches numbers 5000 or higher.

    Try " ([5-9][0-9])|([1-9][0-9][0-9]+) " instead to get things grouped correctly. If you're using the contents of the match (rather than just checking whether a match exists), you'll probably want to add another set of parentheses around the whole thing so that you only need to look in one place to find the match result instead of two places.

    Also note that if you're entering these on the command line, you may (depending on how exactly you arrange your grep command) need to escape the parentheses, pipe character, and plus sign, making the pattern " \([5-9][0-9]\)\|\([1-9][0-9][0-9]\+\) ".

  9. #9
    SitePoint Enthusiast
    Join Date
    Jul 2004
    Location
    Shrewsbury
    Posts
    54
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)

    Red face Thank you

    Thank you very much all. I have got it working with dsheroh post, looks like the main issue was escaping the characters.
    Code:
    tail -f -n1000 /var/messages| grep " \(\([5-9][0-9]\)\|\([0-9][0-9][0-9]\+\)\) "
    Thanks again.


Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •