Say you’re executing some long-running program (maybe a service) multiple times. Each execution creates a new log file in /tmp/. Log files are named something like myprog.log.timestamp.pid. Each log entry is a line of text in the file, containing the log level (e.g. “ERROR”, “INFO”, etc.).

How would you choose a random sample of 10 error messages from the latest execution?

Shell-Foo credit for this one: Eyal Fink.

Shell-Foo is a series of fun ways to take advantage of the powers of the shell. In the series, I highlight shell one-liners that I found useful or interesting. Most of the entries should work on bash on Linux, OS X and other UNIX-variants. Some probably work with other shells as well. Your mileage may vary.

Feel free to suggest your own Shell-Foo one-liners!

The solution

ls -tr /tmp/myprog.log.* | tail -1 | xargs grep ERROR | shuf | head

Tested with bash on Ubuntu 14.04.1.

Explanation

1. ls -tr to list all log files, sorted by time modified (t), in reversed order (r).
2. tail -1 to take the last one.
3. xargs grep ERROR builds a command line by appending the output of the last step to “grep ERROR” and executes it. grep ERROR $file prints all lines in $file that contain the string “ERROR”.
4. shuf shuffles lines from STDIN to STDOUT.
5. head prints the first 10 lines.

Extra tips

This one-liner almost works on OS X. It doesn’t, because shuf is not a built-in tool.

To make it work, just install coreutils (e.g. brew install coreutils), and replace “shuf” with “gshuf”.