use strict;
use warnings;

my $last_line='';
open (DIFFR, "/tmp/log.diff") 
    or die "Can't open /tmp/log.diff: $!";
while (<DIFFR>) {
    chomp;
    if (/\bERROR\b/) {
        print CSVFILE $last_line;
        print CSVFILE "$line,";
    }
    $last_line = $_;
}
[download]

saberworks,
Sometimes it's pointless to use perl.

This is very true. There are plenty of command line utilities and variants that were designed for a very specific task that they do very well. Not an exhaustive list, but I am quite fond of:

• cut
• sort
• uniq
• grep
• tail
• head
The last one is what I wanted to comment on. Not all greps support -B. It is a GNU invention. HPUX and Solaris (at least up to 8), for instance, do not ship with it. When I have to work to make one of these do what I want, I tend to revert back to Perl.

Cheers - L~R

I encounter this problem very frequently on Solaris. My solution is just to install the GNU tools and modify my $PATH accordingly. http://www.sunfreeware.com is a real beaut. If you have a Solaris box without sufficient privileges to do this or an agreeable sysadmin, you have my sympathy.

I also use "sed" quite often and "awk" is nice if you want to grab columns out of a file. Just last week someone told me the letters in awk stand for the names of the developers (Aho, Weinberger, Kernighan).

I actually have command lines about two lines long that I use to work out things like for example which IP addresses are connected to my machine's SMTP port sorted by number of connections. I just haven't gotten around to writting a script or setting up a shell alias to do it yet.

I played with a perl shell once but it didn't feel right (ie I wasn't used to it yet, years of BASH have me in their grasp). Also the control characters (^U, ^A, ^E, etc) didn't work on the main server I use at work (but did on my desktop). I don't remember the shell name but I think it supported commands something like " ls -1 | s/aaa/bbb/g " and more.

In that case I'd use awk to solve this problem.

my $previous;

open F, "< /tmp/log.diff" or die "Unable to open file : $!\n";

while (<F>) {
    chomp;

    if (m/ERROR/) {
        print CSVFILE, "$previous\n$_\n";
    }

    $previous = $_;
}
[download]

open (DIFFR, "/tmp/log.diff") or die "Could not open ;/tmp/log.diff\n"
+;
my $prev = <DIFFR>;
while (my $curr = <DIFFR>) {
   print "$prev$curr" if $curr =~ /ERROR/;
   $prev = $curr;
}
[download]

how about a one-liner? perl -ne "print qq($last\n$_) if /ERROR/; $last=$_" logfile>csvfile

You can add a little logic to the one-liner to cope with more general cases where some ERROR messages don't span two lines (assuming messages all start with a timestamp).

perl -ne 'sub BEGIN {$l="";}$l=$_, next unless /ERROR/;print /^[^12]/ 
+? "$l$_" : $_;$l=$_;' some.log
[download]

Not Y3K compliant.

JohnGG

Note: something is eating the square brackets around the character class ^12 for some reason. Code tags don't help.

There might be an easier way but you could do this:

open (DIFFR, "/tmp/log.diff");
while (<DIFFR>)
{
  $line=$_;
  chomp($line);
  if ($line =~ /ERROR/)
  {
    print CSVFILE "$oldline\n"; #look below if stat.
    print CSVFILE "$line,";
  }
  $oldline = $line; #sets a variable with the last line
}
[download]