I was wondering if it was possible to delete only a portion of the system log files on the Mac OSX El Capitan based on a time period? Say I want to delete all activities that occurred between 9am - 10am. Is that possible to do via Terminal?
Thanks.
1
-
What are you trying to hide? ;)– DavidPostill ♦Commented Dec 26, 2015 at 9:44
Add a comment
|
1 Answer
The files in /var/log/ are owned by root so you'll have to be able to use sudo from Terminal, i.e., be a local admin.
Once you have that, you can use the sed command to perform the actual task with something like this
sudo sed -i -e s/^.*09:[00-59]:[00-59].*$//g /var/log/someLogFile.log
To further explain:
sudoto give you write access to files owned by root-iEdits the file in-place-eTells sed you'll be using a regex command following this options/^.*09:[00-59]:[00-59].*$//ginitiates the sed substitution command for any line logged for all of 09:00:00 to 09:59:59 with nothing (2 consecutive slashes), for all lines (/g)
-
Thanks SaxDaddy. I thought this was working but realized that it wasn't. While Terminal accepts the command with no errors, it didn't seem to delete any lines in the system.log files. Is there something else that I need to add? Perhaps the date?– CandyCommented Feb 5, 2016 at 22:49
-
Actually I just tested it and it works in deleting if I specify a example time such as *09:00:28." but the time range does not seem to be working.– CandyCommented Feb 5, 2016 at 22:59
-
I'd recommend double-checking the regex syntax to make sure it's correct. I know I did before posting but if I have other tools I've installed with homebrew that may have skewed my results.– SaxDaddyCommented Feb 6, 2016 at 3:27
-
Thanks. I think I figured it out. This syntax works: s/^.*09:2[1-9].*$//g. Do you know what command I can use to remove the blank spaces left by the deleted lines?– CandyCommented Feb 7, 2016 at 21:31