last_n_minutes.journald

#!/bin/bash


# Print the last N minutes of standard linux log files
# By Todd Stein - May 12, 2014

# updated for journald on Dec 12, 2017

minutes_to_look_back=$1


if [[ ! $minutes_to_look_back =~ ^[0-9]+$ ]]; then
	echo "Usage: $0 <minutes>" 1>&2
	exit 1
fi


curr_month_num=$(date '+%m')
curr_month_year=$(date '+%Y')
if [[ $curr_month_num == "01" ]]; then # if this month is january
	prev_month_num=12			# then last month was december
	prev_month_year=$((curr_month_year-1))	# then last month's year was one less that this year
else
	prev_month_num=$(printf "%02d\n" "$((${curr_month_num#0}-1))")	# last month is one less
	prev_month_year=$curr_month_year				# last month's year is this year
fi

months=( ZERO Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec ) # element zero exists to allow for easily lookup
curr_month_name="${months[${curr_month_num#0}]}" # expansion strips leading zero to allow for element lookup
prev_month_name="${months[${prev_month_num#0}]}" # expansion strips leading zero to allow for element lookup

time_string='(([0-9]| )[0-9]) ([0-9]{2}):([0-9]{2}):([0-9]{2}).+' # backreferences to "day hour min sec", match rest of line
curr_search_replace="s/^$curr_month_name $time_string/$curr_month_year $curr_month_num \1 \3 \4 \5/g"
prev_search_replace="s/^$prev_month_name $time_string/$prev_month_year $prev_month_num \1 \3 \4 \5/g"



## Print all lines of log_file newer than $minutes_to_look_back minutes old
#
# proposed_target = current seconds since epoch - how many seconds since epoch we want to prune to
# actual_target = 
#	tac - streams log_file backwards to sed
#	| sed - reformats standard timestamp to 'YYYY MM DD HH MM SS' so awk can translate to seconds since epoch
#	| awk - when the timestamp becomes older than our proposed target, print it (translated to seconds since epoch) + exit
#	| date - translate timestamp (seconds since epoch) back to standard linux log format

proposed_target=$(echo "$(date +%s)-60*$minutes_to_look_back" | bc)
#actual_target=$(
#	journalctl -r --no-pager \
#	| sed -r "$curr_search_replace; $prev_search_replace" \
#	| awk -v t=$proposed_target '{if (mktime($0) < t) {print mktime($0); exit}}' \
#	| xargs -rI{} date -d '@{}' '+%b %e %H:%M:%S'
#)

actual_target=$(
	journalctl -r --no-pager -o short-unix -q \
	| awk -v t=$proposed_target -F'[. ]' '{if ($1 < t) {print $1; exit}}' \
	| xargs -rI{} date -d '@{}' '+%b %e %H:%M:%S'
)

# stream log backwards printing all lines until target is reached, then re-invert output
journalctl -r --no-pager -q | awk "/^$actual_target/ {exit}; {print}" | tac