如何仅从日志文件输入最后 30 天的 grep？

Question

我想查看过去 30 天内升级的所有软件包。

所以我运行这个命令：

cat /var/log/apt/history.log | grep -a -A 2 Upgrade

我得到这个 output：

...

Upgrade: gcc-8-base:amd64 (8.3.0-6ubuntu1~18.04.1, 8.3.0-26ubuntu1~18.04), libgcc1:amd64 (1:8.3.0-6ubuntu1~18.04.1, 1:8.3.0-26ubuntu1~18.04), libstdc++6:amd64 (8.3.0-6ubuntu1~18.04.1, 8.3.0-26ubuntu1~18.04)
End-Date: 2020-03-24  10:01:31

--
Upgrade: libsasl2-2:amd64 (2.1.27~101-g0780600+dfsg-3ubuntu2, 2.1.27~101-g0780600+dfsg-3ubuntu2.1)
End-Date: 2020-03-24  10:01:35

--
Upgrade: libsystemd0:amd64 (237-3ubuntu10.33, 237-3ubuntu10.38), libpam-systemd:amd64 (237-3ubuntu10.33, 237-3ubuntu10.38), systemd:amd64 (237-3ubuntu10.33, 237-3ubuntu10.38), libnss-systemd:amd64 (237-3ubuntu10.33, 237-3ubuntu10.38)
End-Date: 2020-03-24  10:01:43

--
Upgrade: vim-common:amd64 (2:8.0.1453-1ubuntu1.1, 2:8.0.1453-1ubuntu1.3), vim-runtime:amd64 (2:8.0.1453-1ubuntu1.1, 2:8.0.1453-1ubuntu1.3), vim:amd64 (2:8.0.1453-1ubuntu1.1, 2:8.0.1453-1ubuntu1.3), vim-tiny:amd64 (2:8.0.1453-1ubuntu1.1, 2:8.0.1453-1ubuntu1.3)
End-Date: 2020-03-24  10:01:49

--
Upgrade: linux-headers-generic:amd64 (4.15.0.74.76, 4.15.0.91.83), linux-image-generic:amd64 (4.15.0.74.76, 4.15.0.91.83), linux-generic:amd64 (4.15.0.74.76, 4.15.0.91.83)
End-Date: 2020-03-24  10:02:29

--
Upgrade: git:amd64 (1:2.17.1-1ubuntu0.5, 1:2.17.1-1ubuntu0.7)
End-Date: 2020-04-27  08:31:00

--
Upgrade: git-man:amd64 (1:2.17.1-1ubuntu0.5, 1:2.17.1-1ubuntu0.7)
End-Date: 2020-04-27  08:31:06

--
Upgrade: python3-apport:amd64 (2.20.9-0ubuntu7.12, 2.20.9-0ubuntu7.14)
End-Date: 2020-04-27  08:31:09

--
Upgrade: python3-problem-report:amd64 (2.20.9-0ubuntu7.12, 2.20.9-0ubuntu7.14)
End-Date: 2020-04-27  08:31:12

--
Upgrade: apport:amd64 (2.20.9-0ubuntu7.12, 2.20.9-0ubuntu7.14)
End-Date: 2020-04-27  08:31:20


...

现在我只想 grep 在过去 30 天内附加到文件的行。 而且我希望它始终与我当前的时间相关，所以我不必每次运行命令时都更改语法和日期，所以总是 30 天。 如您所见，行中有日期，所以应该是可能的，但语法对我来说很复杂。

Answer 1

我会调整 kvantour 的答案如下，因为Upgrade:和End-Date:之间有一条额外的线：（有时会发生）：

awk -v d="$(date -d "today -30 days" "+%F %T")" '
  /^End-Date: /{if (t && $2" "$3 > d) {print t; print $0; t=""}}
  /^Upgrade: / {t=$0}
' /var/log/apt/history.log

Answer 2

您可以执行以下操作：

$ awk -v d="$(date -d "today -30 days" "+%F %T")"   \
      '(t && $2" "$3 > d){print t;print $0;t=""}
       /Upgrade/{t=$0}' log-file