Grep X number of lines after matching pattern is found

[root@ltm02:Active:Standalone] config # zless /var/log/ltm* | grep -A 2 "16:03:23" -n
230:May  3 16:03:23 ltm02 notice bigd[5171]: 01060001:5: Service detected UP for ::ffff:172.16.4.10:80 monitor /Common/site1-http-mon.
231-May  3 16:03:24 ltm02 notice bigd[5171]: 01060001:5: Service detected UP for ::ffff:172.16.4.20:80 monitor /Common/site1-http-mon.
232-May  3 16:03:24 ltm02 notice mcpd[4647]: 01070727:5: Pool /Common/site1.dc1.networkology.net member /Common/172.16.4.10:80 monitor status up. [ /Common/site1-http-mon: up ]  [ was down for 3hrs:25mins:55sec ]

The above example greps 2 lines after the matching pattern “16:03:23” is found.

• -A denotes to print lines after the line of matching pattern and it takes a number argument. In this case, the number 2 was specified as the argument for -A, so it printed the immediate 2 lines after the pattern was found.
• -n prints the line number as per the number of lines in the input file ltm*
• The colon in 230: denotes the matching line
• The hyphen in 229- and 228- denotes the line number of the next two lines printed after the matching line

Grep X number of lines that come before the line where matching pattern is found

[root@ltm02:Active:Standalone] config # zless /var/log/ltm* | grep -B 2 "16:03:23" -n
228-May  3 12:37:29 ltm02 notice mcpd[4647]: 010719e8:5: Virtual Address /Common/64.25.36.10 monitor status changed from UP to DOWN.
229-May  3 12:37:29 ltm02 err tmm[12029]: 01010028:3: No members available for pool /Common/site1.dc1.networkology.net
230:May  3 16:03:23 ltm02 notice bigd[5171]: 01060001:5: Service detected UP for ::ffff:172.16.4.10:80 monitor /Common/site1-http-mon.

The above example greps 2 lines before the matching pattern “16:03:23” is found.

• -B denotes to print lines before the line of matching pattern and it takes a number argument. In this case, the number 2 was specified as the argument for -B, so it printed the immediate 2 lines before the pattern was found.
• -n prints the line number as per the number of lines in the input file ltm*
• The colon in 230: denotes the matching line
• The hyphen in 229- and 228- denotes the line number of the previous two lines printed before the matching line

Grep logs between a range of time

zless /var/log/ltm* | grep "May\s*3 [1][2]:[2][0]:[3-4][0-9]" 
zless /var/log/ltm* | grep "MONTH\s*DATE [H][H]:[M][M]:[S-S][S-S]" 

The above will display log events between 12:20:30 and 12:20:49 on May 3.

• \s* – this matches one or more white space characters between the month and the date.
• To print range of logs between 12:15:00 and 12:24:59, the minutes section needs to be broken down into 10 minute intervals by keeping the place value of ‘tens’ constant in each range to accurately use this method of grepping;

12:15:00 to 12:19:59
12:20:00 to 12:24:59

This results in having two grep patterns for each of the above range;

zless /var/log/ltm* | grep "May\s*3 [1][2]:[1][5-9]:[0-9][0-9]\|May\s*3 [1][2]:[2][0-4]:[0-9][0-9]"

The beauty of this command is that your pattern does not have to match a specific keyword because your pattern matches a range of keywords (or numbers in this case).

Let me know if there’s a better way to grep without worrying about the multiple ranges to be created!

Grep logs between a specific range of time

zless /var/log/ltm* | grep "/May *3 12:20:42/,/May *3 12:25:38/"

This is a pretty easy one to run but the problem with this grep format is you have to know the specific time to match or else it won’t return any output.