如何在linux shell中用sed选择内容

Question

在我的项目中,我有一个linux文件:audit_check.log

audit_check.log的内容如下:

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD
2019-01-08 15:10:30,root     pts/0        2019-01-08 11:30 ,root,vm1, 3115  cat /var/log/audit_check.log,/root/USER_CD
2019-01-08 15:10:51,root     pts/0        2019-01-08 11:30 ,root,vm1, 3116  echo yang > xie,/root/USER_CD
2019-01-08 15:10:54,root     pts/0        2019-01-08 11:30 ,root,vm1, 3117  rm -rf xie,/root/USER_CD
2019-01-08 15:10:56,root     pts/0        2019-01-08 11:30 ,root,vm1, 3118  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:11:35,root     pts/0        2019-01-08 11:30 ,root,vm1, 3119  vi keycmd.sh ,/root/USER_CD
2019-01-08 15:11:39,root     pts/0        2019-01-08 11:30 ,root,vm1, 3120  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:11:39,root     pts/0        2019-01-08 15:09 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD
2019-01-08 15:12:39,root     pts/0        2019-01-08 11:30 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD

现在,我想在同一分钟内选择所有行.

例如,when times是:

2019-01-08 15:09

正确的结果应该是:

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD

但是这条线:

2019-01-08 15:11:39,root     pts/0        2019-01-08 15:09 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD

在结果中排​​除.

我试过了:

timestr=`date +%Y-%m-%d" "%H:%M`

 sed -n '/^$timestr/p' /var/log/audit_check.log  > /tmp/keycmdtmp.log

但/tmp/keycmdtmp.log为空.当我删除"^"像:

timestr=`date +%Y-%m-%d" "%H:%M`

sed -n '/$timestr/p' /var/log/audit_check.log  > /tmp/keycmdtmp.log

结果更改为:

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD
2019-01-08 15:11:39,root     pts/0        2019-01-08 15:09 ,root,vm1, 3120  rm keycmd.sh ,/root/USER_CD

It seems nothing wrong, who can help me?

Answer 1

这更适合awk:

awk -F, -v dt="$(date '+%Y-%m-%d %H:%M')" '$1 ~ dt' file

2019-01-08 15:09:32,root     pts/0        2019-01-08 11:30 ,root,vm1, 3111  sh keycmd.sh ,/root/USER_CD
2019-01-08 15:09:40,root     pts/0        2019-01-08 11:30 ,root,vm1, 3112  cat /tmp/keycmdtmp.log ,/root/USER_CD