#!/bin/bash # read from STDIN, lines coming from rsyslog files. Pass to STDOUT any line with timestamp younger than 10 mins while read -r LINE; do D="${LINE:0:10}" echo $D D=$( echo $D | awk -F/ '{print $2 "/" $3 "/" $1}') echo $D DT="${D} ${LINE:11:8}" echo $DT DT=$(date --date="${DT}" +"%s") (( SECS = NOW - DT )) if [[ ${SECS} -lt 601 ]] ; then echo "$LINE" fi done