patterntail - A shell script to examine log files

patterntail searches a file (generally a log file) for the occurrence of a particular pattern, and if the pattern is found, outputs the contents of the file from that point to the standard output (à la tail).

The default is to search for the first occurrence of the pattern in the file. But one may specify the Nth occurrence of the pattern (with -c count).

The reverse option (-r) searches for the last (or Nth last) occurrence of the pattern.

Normally, the pattern will specify some kind of timestamp - but it can be any pattern.

patterntail is intended to be used to search through system administration logs - e.g., Oracle alert logs, Linux system logs, etc. It always searches relevant to "now", when it's started.

patterntail Usage Message

$ patterntail usage: patterntail [options] filename Where options are: [-f Format_string] default: %Y%m%d [-c count] default: 1 [-i lookback_iterations] default: 1 [1 to 25] [-s lookback_seconds] default: 86400 (1 day) [>=0] [-r] reverse search default: forward (from the start of the file) [-v] increase verbosity (sent to stderr)

Download patterntail from the github repository.

patterntail Examples

List the contents of an Oracle alert log file starting at the first occurrence of the current date (now) - in 2 formats:

$ patterntail -f '^%a %b %d ..:..:.. %Y|^%Y-%m-%dT..:..:..' oracle_alert_log (no output shown)

Same again, but with verbose mode:

$ patterntail -v -f '^%a %b %d ..:..:.. %Y|^%Y-%m-%dT..:..:..' oracle_alert_log REGEXP=[^Sat Oct 12 ..:..:.. 2019|^2019-10-12T..:..:..] ESCAPEDREGEXP=[^Sat Oct 12 ..:..:.. 2019|^2019-10-12T..:..:..] (no output shown)

List the contents of ssl_request_log starting with the first occurrence of a timestamp containing the current date, hour and minute or any of the previous 4 minutes:

# patterntail -s 60 -i 5 -f '^\[%d/%b/%Y:%H:%M:..' ssl_request_log [12/Oct/2019:14:31:48 +1100] 10.3.2.10 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /staff/shell_scripts/patterntail/patterntail.php HTTP/1.1" 3502 [12/Oct/2019:14:32:48 +1100] 10.3.2.10 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /staff/staff.css HTTP/1.1" - [12/Oct/2019:14:32:48 +1100] 10.3.2.10 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /staff/images/background.png HTTP/1.1" - [12/Oct/2019:14:34:49 +1100] 10.3.2.10 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /staff/shell_scripts/patterntail/patterntail.php HTTP/1.1" 3502 [12/Oct/2019:14:35:49 +1100] 10.3.2.10 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /staff/staff.css HTTP/1.1" - [12/Oct/2019:14:35:49 +1100] 10.3.2.10 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /staff/images/background.png HTTP/1.1" -