Lairds Computer Services

Sometimes you need to be able to find out who has downloaded a file within a certain time period, the following is a bash script using grep and awk that will allow you to parse apache logs to see what users downloaded a file in a certain time period:

grep 'somefile.wmv' /var/log/apache2/*.log | cut -f1,3,4 -d' ' | sort | tr -d '[' | tr '/' ':' | awk '{ split($3,a,":"); if(a[3] == 2011 && a[2] == "Dec" && a[1] >= 20 && a[1] <= 24 && a[4] >= 0 && a[4] <= 13 && a[5] >= 0 && a[5] <= 45) { print $0 } }' | more

Where a[1] is the date range and a[4]:a[5] is the time range.  What this returns is a list of users who have downloaded the file within the specified time period.