I would like to output a file with install/upgrade logs limited to the past month by looking in /var/log/dpkg.log.
I do not know bash, I know that the grep command could make it, but I still need some help.
2 Answers
$ grep "install\|upgrade" /var/log/dpkg.log | grep "2021-01" > log.dat Sample output:
2021-01-11 23:05:50 status installed mime-support:all 3.62 2021-01-11 23:05:50 status installed hicolor-icon-theme:all 0.17-2 2021-01-11 23:05:53 status installed shared-mime-info:amd64 1.10-1 2021-01-12 11:11:57 install python3-configobj:all <none> 5.0.6-3 2021-01-12 11:11:57 status half-installed python3-configobj:all 5.0.6-3 2021-01-12 11:11:57 install python3-psutil:amd64 <none> 5.5.1-1 2021-01-12 11:11:57 status half-installed python3-psutil:amd64 5.5.1-1 Awk is an ideal solution for this (GNU awk to take advantage of the gensub function)
awk -v tstamp="$(date -d "-30 days" +%s)" '/install/ || /upgrade/ {dconv=gensub("-"," ","g",$1);tconv=gensub(":"," ","g",$2);dstamp=mktime(dconv" "tconv);if (dstamp >= tstamp ) { print } }' /var/log/dpkg.log Explanation:
awk -v tstamp="$(date -d "-30 days" +%s)" ' # Pass the date minus 30 days as variable to awk (tstamp) /install/ || /upgrade/ { # Process where lines contain install or upgrade dconv=gensub("-"," ","g",$1); # Replace "-" for " " in the first space delimited field (date) and read result into dcon tconv=gensub(":"," ","g",$2); # Replace ":" for " " in the second space delimited field (time) and read the result into tconv dstamp=mktime(dconv" "tconv); # Create epoch format of date and time if (dstamp >= tstamp ) { # See whether date/time is within 30 days by comparing dstamp to tstamp print # Print line if condition is met } }' /var/log/dpkg.log 
