Linux - tail Starting from Specific Line
We often work with log files, and maybe some of them are huge files. And worse, those files are in isolated (or secured) environment that prevent us to copy out those files, or allowing us to work with our preferred tools. To make our investigation (or life) easier, we need to isolated (or pinpoint) to specific part of files. Maybe we can start from specific line number? How to output from a file starting from a specific line?
Specify Specific Line
So which line? Start from line 1000? From line 50000? Random line or specific line. If we know specific search term to start, we can use following grep command.
grep -m 1 -n '<search-term>' <filename>
$ grep -m 1 -n '2019-04-09' fail2ban.log 37371:2019-04-09 00:12:51,750 fail2ban.filter [20293]: WARNING Determined IP using DNS Lookup: mail.btce.com = ['139.59.173.161']
grep options:
-n = include line number
-m 1 = match one
So in above example, I start to look from specific date '2019-04-09'. Now, we get a starting line number. Next is...
tail starting from specific line
We can use tail command with following switch:
tail --lines=+<start-line> <filename> tail -n +<start-line> <filename>
Like this:
tail --lines=+37371 fail2ban.log
Or if using cat command, combined with awk:
cat fail2ban.log | awk '{if (NR>=37371) print}'
It'll be even better if we know the ending line number.
Output File From And End in Specific Line
We can use head combined with tail, or sed command, or again combination of cat and awk. All following commands will reading lines 500,000-510,000
tail -n+500000 file.in | head -n10000 head -n510000 file.in | tail -n10000 sed -n '500000,509999p' file.in tail -n500001 file.in | head -n10000 cat file.in | awk '{if (NR>=500000 && NR<510000) print}'
Yes, many options available, but my preferences is head and tail combination.
You can generate 1,000,000-line file by using "seq 100000000 > file.in"
Desson AriawanProgrammer