Gfilui

I am working on script where I will be receiving inputs as time and foldername,I need to find a file (snort.log.*) which is falling in that time range what my user enters (he will be seeing the alert file the bold time stamp and entering that time for actual snort.log.** file which contains the details of attack and alert file contains the metadata only)
here is directory sample

[jump1@widids01 snort-3]# ls -ltr | tail -6
-rwxr-x--- 1 snort snort 301731 Feb 2 18:18 snort.log.1517557015
-rwxr-x--- 1 snort snort 5720853 Feb 5 21:11 snort.log.1517563475
-rwxr-x--- 1 snort snort 3566073 Feb 7 16:00 snort.log.1517832965
-rwxr-x--- 1 snort snort 18999 Feb 7 20:46 snort.log.1518003111
-rwxr-x--- 1 snort snort 20705098 Feb 15 19:00 snort.log.1518004113
-rw------- 1 snort snort 357271 Feb 15 22:22 snort.log.1518688923
-rwxr-x--- 1 snort snort 50782147 Feb 15 22:22 alert
[jump1@widids01 snort-3]# tail -3 alert
02/15-18:22:02.204655 [1:2403380:38412] ET CINS Active Threat Intelligence Poor Reputation IP TCP group 41 [Classification: Misc Attack] [Priority: 2] TCP 
02/15-22:22:03.335107 [1:2403408:38412] ET CINS Active Threat Intelligence Poor Reputation IP TCP group 55 [Classification: Misc Attack] [Priority: 2] TCP 
02/15-22:22:03.335107 [1:2403408:38412] ET CINS Active Threat Intelligence Poor Reputation IP TCP group 55 [Classification: Misc Attack] [Priority: 2] TCP

I am facing the issues here the snort.log.[epoch] i.e [epoch] is file generated time, so if user enters

testcase1:

time:2015-02-15-22:28:02 

how to give him the matching snort.log.file for where the attack data contains

testcase2:

time:2015-02-15-18:22:02

how to give him the matching snort.log.file for where the attack data contains

I tried with find . -newermt "2018-02-15 18:38:00" ! -newermt "2018-02-15 18:39:00" I am not getting proper output.

Assuming you have an input like this:

time="time:2015-02-15-18:22:02"

Then you can convert it to a Unix timestamp (seconds since epoch) and save it in variable timestamp with:

time=$(date -d$(<<<"$time" sed 's/time:(.*)-/1T/') +%s)

I use sed here to get rid of the time: prefix and change the colon between date and time to T (ISO 8601), date is then used to convert the timestamp to seconds since epoch.

Depending on what this timestamp represents you can then use find to output the log's filename:

• if the filename already contains the timestamp, you can use snort.log.$time directly



• 
  

  if it's the file's modification time:

  
  
  

  find . -type f -name "*snort.log.*" -newermt @$(($time-1)) ! -newermt @$time
  

  
  
  

  This will find every log file with a modification time between time - 1 second and time.

  
  


• 
  

  if you need to find the oldest log file from after the given timestamp, you can use sort and head:

  
  
  

  find . -type f -name "*snort.log.*" -newermt @$(($time-1)) -print0 | sort -z | head -zn1
  

  
  


• 
  

  if you need to find the log file that (in any way) contains the given timestamp, use grep:

  
  
  

  grep -l $time *
  

  
  
  

  If you have a lot of long log files maybe combine this with find and/or parallel to make it faster, e.g.:

  
  
  

  find . -type f -name "*snort.log.*" -newermt @$(($time-1)) -exec grep -l $time +