regex - 如何在 linux shell 中使用 sed 选择内容

Question

在我的项目中，我有一个 linux 文件:audit_check.log

audit_check.log的内容是这样的:

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD
2019-01-08 15:10:30,root     pts/0        2019-01-08 11:30 ,root,vm1, 3115  cat /var/log/audit_check.log,/root/USER_CD
2019-01-08 15:10:51,root     pts/0        2019-01-08 11:30 ,root,vm1, 3116  echo yang > xie,/root/USER_CD
2019-01-08 15:10:54,root     pts/0        2019-01-08 11:30 ,root,vm1, 3117  rm -rf xie,/root/USER_CD
2019-01-08 15:10:56,root     pts/0        2019-01-08 11:30 ,root,vm1, 3118  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:11:35,root     pts/0        2019-01-08 11:30 ,root,vm1, 3119  vi keycmd.sh ,/root/USER_CD
2019-01-08 15:11:39,root     pts/0        2019-01-08 11:30 ,root,vm1, 3120  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:11:39,root     pts/0        2019-01-08 15:09 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD
2019-01-08 15:12:39,root     pts/0        2019-01-08 11:30 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD

现在，我想在同一分钟内选择所有行。

例如，当 timestr 为:

2019-01-08 15:09

正确的结果应该是:

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD

但是行:

2019-01-08 15:11:39,root     pts/0        2019-01-08 15:09 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD

在结果中排​​除。

我试过了:

timestr=`date +%Y-%m-%d" "%H:%M`

 sed -n '/^$timestr/p' /var/log/audit_check.log  > /tmp/keycmdtmp.log

但是/tmp/keycmdtmp.log 是空的。当我删除“^”时:

timestr=`date +%Y-%m-%d" "%H:%M`

sed -n '/$timestr/p' /var/log/audit_check.log  > /tmp/keycmdtmp.log

结果改为:

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD
2019-01-08 15:11:39,root     pts/0        2019-01-08 15:09 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD

It seems nothing wrong, who can help me?

Answer 1

这更适合awk:

awk -F, -v dt="$(date '+%Y-%m-%d %H:%M')" '$1 ~ dt' file

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD