sed -rne '/Wed Aug 19 21:34:00/,/Wed Aug 19 21:40:00/ p' logfile.log
The timestamp in the log file in this case was in the following format:
Wed Aug 19 21:39:59 2020
sed -rne '/Wed Aug 19 21:34:00/,/Wed Aug 19 21:40:00/ p' logfile.log
The timestamp in the log file in this case was in the following format:
Wed Aug 19 21:39:59 2020
last reboot | less
last -x | head | tac
Examples of output:
runlevel (to lvl 0) ... <-- first the system shuts down (init level 0)
reboot system boot ... <-- afterwards the system boots
runlevel (to lvl 2) 2.6.24-... Sat Sep 10 11:07 - 11:01 (2+23:34)
runlevel (to lvl 3) ... <-- the system was running since this momemnt
reboot system boot ... <-- then we've a boot WITHOUT a prior shutdown
runlevel (to lvl 3) 3.10.0-693.21.1. Sun Jun 17 15:40 - 09:51 (18:11)
Disk space remains the same pre and post file deletion. It is likely a process is still using the deleted file. To get a list of deleted files which are still marked open by processes:
lsof +L1
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME
tuned 111 root 7u REG 202,2 4333091 0 2141 /tmp/jar_cache23323.tmp (deleted)
Simply kill the process to dump the file in question:
kill -9 111
ps -o rss -C httpd | tail -n +2 | (sed 's/^/x+=/'; echo x) | bc
Recent Comments