如何使用sort命令但不使用ls -lrt命令列出文件

Question

I am writing a shell script to check some parameters like errors or exception inside the log files which are getting generated in last 2 hours inside the directory /var/log. So this is command I am using:

find /var/log -mmin -120|xargs egrep -i "error|exception"

It is displaying the list of file names and its corresponding parameters(errors and exceptions) but the list of files are not as per the time sequence. I mean the output is something like this(the sequence):

/var/log/123.log:RPM returned error
/var/log/361.log:There is error in line 1
/var/log/4w1.log:Error in configuration line

But the sequence how these 3 log files have been generated is different.

/var/log>ls -lrt
Dec24 1:19 361.log
Dec24 2:01 4w1.log
Dec24 2:15 123.log

So I want the output in the same sequence,I mean like this:

/var/log/361.log:There is error in line 1
/var/log/4w1.log:Error in configuration line
/var/log/123.log:RPM returned error

I tried this:

find /var/log -mmin -120|ls -ltr|xargs egrep -i "error|exception"

but it is not working. Any help on this is really appreciated.

Answer 1

If your filenames don't have any special characters (like newline characters, etc), all you need is another call to xargs :

find . -type f -mmin -120 | xargs ls -tr | xargs egrep -i "error|exception"

Or if your filenames contain said special chars:

find . -type f -mmin -120 -print0 | xargs -0 ls -tr | xargs egrep -i "error|exception"

Answer 2

You can prepend the modified time using the -printf argument to find , then sort , and then remove the modified time with sed :

find /var/log -mmin -120 -printf '%T@:%p\n' | sort -V | sed -r 's/^[^:]+://' | xargs egrep -i "error|exception"

• find ... -printf '%T@:%p\\n' prints out each found file ( %p ) prepended by the seconds since the UNIX epoch ( %T@ ; eg, 1419433217.1835886710 ) and a colon separator ( : ), each on a new line ( \\n ).

• sort -V sorts the files naturally by modification time because it is at the beginning of each line (eg, 1419433217.1835886710:path/to/the/file ).

• sed -r 's/^[^:]+://' takes each line in the format 123456789.1234:path/to/the/file and strips out the modification time leaving just the file path path/to/the/file