#! /bin/sh

# Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
#
# This script prints the last part of a syslog-timestamped file to the
# stdout according to a time specification.  By default the last day of
# msgs written to /var/log/messages is printed. Options:
# --last <time>    collect most recent msgs up to <time> (default 1 day)
# --bytes N        cap collected data at N bytes (default 130K)
#
# Note option order is important (TODO(sleffler) rewrite w/ shflags)

if [ "$1" = "--last" -o "$1" = "-l" ]; then
  LAST="$2"; shift; shift
else
  LAST='1 day'
fi
if [ "$1" = "--bytes" -o "$1" = "-c" ]; then
  MAXDATA="$2"; shift; shift
else
  # NB: 1000 lines at 132 chars/line is ~130Kbytes
  MAXDATA='130K'
fi
LOGFILE=${1:-/var/log/messages}

# create list of files assuming normal log rotation

LOGFILES="${LOGFILE}"
local BASENAME="${LOGFILE%%.*}"
local EXTENSION="${LOGFILE#*.}"
if [ "${BASENAME}" = "${EXTENSION}" ]; then
  EXTENSION=""
else
  EXTENSION=".${EXTENSION}"
fi
for i in 1 2 3 4 5 6 7 8 9; do
  FILE="${BASENAME}".$i${EXTENSION}
  [ -f "$FILE" ] || break
  LOGFILES="${LOGFILES} $FILE"
done

WHEN="now - $LAST"
DATE=$(date -d "$WHEN" +'%FT%T.000000%:z')

tac $LOGFILES \
  | awk -v DATE="$DATE" '{ if ($1 < DATE) exit; print }' \
  | tac \
  | tail -c $MAXDATA