UNIX for Dummies Questions & Answers

Hi,

I have a large, multiline log file.

I have used pcregrep to extract all entries in that log that match a particular pattern - where that pattern spans multiple lines.

However, because the log file is large, and these entries occur every few minutes, I still output a very large amount of data.

All I am actually looking for is the last occurrence of the patter match in the log. Grep allows me to specify number of matches, but only works on single lines. pcregrep allows multiple lines, but does not limit matches.

I guess the ideal solution is a way of running a regex match from the base of the log upwards, and stopping at the first full match.

Can someone suggest a sensible solution?

Cheers,

Ben

Can you show us example of input file and expected output?

Theres quite a lot of it... but summarizing:

<timestamp> checkStatus SUCCESS [
many lines of varied text
]

All other lines of the log will not match the above, and will be of the form:

<timestamp> <some other call> .......[

]
I successfully matched this pattern, but it matches every entry - and there are a few hundred in the current log. I have piped them all to a file, but still extracting the last match is a problem...

What I am trying to extract is the most recent match of the pattern - so that nearest the base of the file.

---------- Post updated at 11:01 AM ---------- Previous update was at 09:45 AM ----------

I have sort of achieved what I need...

tail -n500 <myLog>.log | sed -n '/^.*checkStatus SUCCESS/,/]/ p'

This gives me the output I want, but has two limitations:

If the entry, for whatever reason, does not appear in the arbitrarily chosen last 500 lines of the log, then no match is returned

If it appears twice, then it is returned twice...

Try:

Code:

perl -ln0e '/(checkStatus SUCCESS.*?\]).*?$/s;print "$1\n"' mcsystemstatusmanager.log

Didn't test it though.

A definite improvement, in that it returns only one match - however, it starts the match from the start of the log file, so I end up with the first, not the last match...

OK, try this:

Code:

perl -ln0e '@a=/(checkStatus SUCCESS.*?\])/gs;print "$1\n"' mcsystemstatusmanager.log

This time I've tested it :P

Yes - that has done it - thanks!

Can I ask you eactly what it is doing though? They key changes seem to be the addition of the /g flag, and the @a= at the start of the regex...

Ben