#!/bin/sh

#return the last x days from an "NCSA combined" format HTTP log

days=$1
log="$2"

export LANG=C #for speed
export TZ=UTC0

last_log_date=`tail -1 "$log" |
               sed 's#.*\[\([^:]*\):\([^ ]*\) .*#\1 \2#g' |
               tr '/' ' '`
yesterday=`date --date="$last_log_date $days day ago" +"%d/%b/%Y:%H:%M"`

#match to within 10 mins (assuming a log entry every min is too much in general)
yesterday=`echo $yesterday | cut -b-16`
yesterday="$yesterday[0-9]"

tac "$log" | sed "\#$yesterday#Q"