The Chalkboard

Robert Hawdon's Knowledge Base

Tailing timestamped logs from a specified time using awk

Published: [2026-10-05 Mon 11:33] (Last Updated: [2026-10-05 Mon 11:43])

Introduction

Sometimes, someone will ask for you to send logs for a specific log file from a certain time onwards. This can be a problem if the log file is large. Sure you could open vim and remove lines from before a timestamp and write it out to a new file, but surely there's a better way. That's where awk can come into play.

Using `awk` to tail logs

Finding the timestamp format

Of course, every app will probably format their timestamps differently, so you'll probably want to use head to view an example from the start of the file.

Running awk

Now, let's say you find the file's timestamps start at the beginning of each line, and the file is rotated weekly on a Sunday. The first line of the log file might contain the following: 2026-10-04 00:00:00 - INFO: Example log

We can use Regex to match logs at a specific time, and print to the end of the file:

awk '/^2026-10-05 08:00:00/{found=1} found' /var/log/app.log

This will print the output to stdout, so you'll probably want to pipe it to a file:

awk '/^2026-10-05 08:00:00/{found=1} found' /var/log/app.log > ~/app-log-2026-10-05_08-00-00.log

DISCLAIMER: The information provided on this website is generated from my own notes and is provided "as is" and without warranties. Robert Ian Hawdon can not be held responsible for damages caused by following a guide published on this site. This website contains links to other third-party websites. Such links are provided as convienice of the reader. I do not endorce the contents of these third party sites.