#!/bin/bash
#
# pre-filter 2006-09-05, last modified 2007-01-14
#
# output record stream from a set of logfiles in date order, starting with 
#  the first logfile containing the requested record date, intended as a 
#  pre-filter for the datestamp-filter program which parses actual record 
#  datestamps with an optional line offset.
#
# Copyright (C) 2006, 2007 Grant Coady <grant@bugsplatter.id.au> GPLv2
#
# Home page: <http://bugsplatter.id.au/awk>
#
# 2007-01-13	Use log 'modify time', not 'change time', better debug 
#		 reporting to discover this bug.
#

debug_log="/tmp/pre-filter-debug-log"	# comment out to disable debug log

[ $debug_log ] && echo "pre-filter: start $(date), parms: $1 $2" > $debug_log

default="-21"				# set most recent default days

# first parameter is the datestamp, it may be positive date in epoch 
#  seconds, or a negative number of days before the script start time

now_stamp=$(date +%s)			# current epoch seconds

# force input to zero for error, this will signal default value to be used
inp=$(( $1 + 0 ))			# date must be a number
[ $inp -gt $now_stamp ] && inp=0	# date must not be in future

[ $inp -eq 0 ] && inp=$default		# perhaps set default

if [ $inp -gt 0 ]
then
	# positive value is start time in epoch seconds (`man date`), 
	#  for example: $(date -d "2006-07-01 00:00" +%s)
	start=$inp
else
	# negative value is most recent days, example: -21 for last 3 weeks
	start=$(( now_stamp + (inp * 24 * 60 * 60) ))
fi

# optional second parameter specifies something other than /var/log/messages, 
#  assumes the usual `logrotate` file naming, compression is optional
logfile="/var/log/messages"
[ -n "$2" ] && [ -r "$2" ] && logfile=$2

loglist=$(mktemp -t XXXXXX)		# temp file candidate logfile, get 
ls -rt $logfile* > $loglist		#  list files in reverse date order

while read lf
do
	# discard files prior to wanted date
	mtime=$(stat --format=%Y $lf)
	[ $debug_log ] && echo -n "log: $mtime $lf " >> $debug_log
	if [ $mtime -lt $start ]
	then
		[ $debug_log ] && echo "discard" >> $debug_log
		continue
	else
		[ $debug_log ] && echo "accept" >> $debug_log
		
		# output file records, decompressing as required
		case $lf in
			*.bz2 ) bzcat $lf;;
			*.gz  )  zcat $lf;;
			*     )   cat $lf;;
		esac
	fi
done < $loglist

rm $loglist
[ $debug_log ] && echo "pre-filter: finish $(date)." >> $debug_log
# end