No sé si ha dejado de interesarte el asunto, si has encontrado la solución o si hay alguna otra razón para que no hayas seguido con esto. De todas formas como ya me he metido en el asunto y por si le puede servir a alguien he decidido aportar alguna solución a la vez que concreto un posible formato de un log. Me he basado en el ERROR.LOG de Apache que he localizado, en mi instalación, en C:\Apache\Logs y que tiene este aspecto:
Starting the Apache2.2 service
httpd.exe: Could not reliably determine the server's fully qualified domain name, using 192.168.173.1 for ServerName
[Wed Dec 02 10:04:28 2015] [notice] Apache/2.2.25 (Win32) configured -- resuming normal operations
[Wed Dec 02 10:04:28 2015] [notice] Server built: Jul 10 2013 01:52:12
[Wed Dec 02 10:04:28 2015] [notice] Parent: Created child process 2768
httpd.exe: Could not reliably determine the server's fully qualified domain name, using 192.168.173.1 for ServerName
httpd.exe: Could not reliably determine the server's fully qualified domain name, using 192.168.173.1 for ServerName
[Wed Dec 02 10:04:37 2015] [notice] Child 2768: Child process is running
[Wed Dec 02 10:04:37 2015] [notice] Child 2768: Acquired the start mutex.
[Wed Dec 02 10:04:37 2015] [notice] Child 2768: Starting 64 worker threads.
[Wed Dec 02 10:04:37 2015] [notice] Child 2768: Starting thread to listen on port 80.
[Wed Dec 02 10:04:58 2015] [notice] Parent: Received shutdown signal -- Shutting down the server.
[Wed Dec 02 10:04:58 2015] [notice] Child 2768: Exit event signaled. Child process is ending.
[Wed Dec 02 10:04:59 2015] [notice] Child 2768: Released the start mutex
[Wed Dec 02 10:05:00 2015] [notice] Child 2768: All worker threads have exited.
[Wed Dec 02 10:05:00 2015] [notice] Child 2768: Child process is exiting
[Wed Dec 02 10:05:00 2015] [notice] Parent: Child process exited successfully.
httpd.exe: Could not reliably determine the server's fully qualified domain name, using 192.168.173.1 for ServerName
[Wed Dec 02 10:05:14 2015] [notice] Apache/2.2.25 (Win32) configured -- resuming normal operations
[Wed Dec 02 10:05:14 2015] [notice] Server built: Jul 10 2013 01:52:12
Tiene algunas dificultades interesantes, como presentar el mes en formato texto y el uso de [ y ] para delimitar la parte de fecha.
Este es el BAT que propongo para extraer de ese log la información correspondiente a los 3 últimos días:
@echo off
Setlocal EnableDelayedExpansion
set carpeta=c:\Apache\logs
set archivo=error.log
set /a dias=3
pushd %carpeta%
del /q %dias%dias.log>nul 2>&1
for /f "skip=1 delims=" %%x in ('wmic os get localdatetime') do set Fecha=%%x&goto :seguir
:seguir
set /a Fecha=%Fecha:~0,8% - %dias%
for /f "tokens=1,2,3,4,5*" %%a in ('type %archivo%') do (
set aaaa=%%e&set aaaa=!aaaa:~0,4!
if !aaaa! lss 2050 (
call :convmes %%b
if !aaaa!!mm!%%c gtr %Fecha% echo %%a %%b %%c %%d %%e %%f>>%dias%dias.log
)
)
popd
goto :eof
:convmes
set i=0
for %%x in (Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec) do (
set /a i+=1 & echo/%1|findstr /i /b "%%x" >nul && call set mm=%%i%%
)
(if 1%mm% LSS 110 set mm=0%mm%)
goto :eof
El número de días es configurable en la variable DIAS y la extracción se deja con el nombre Ndias.log en la misma carpeta en la que está el log de partida.