oxlog: want a way to list N most recent log files

[hawkw]

When debugging, log rotation may have occurred at some point during the event of interest. In that case, it's often useful to be able to inspect the current log file for a service plus the archived log file immediately prior to the current one. Doing this with oxlog is presently somewhat difficult, because archived log files may exist across multiple datasets, and piping oxlog into sort(1) will not output the log files in chronological order, since they are sorted by the UUID of the dataset before sorting chronologically. This is unfortunate.

It would be nice if oxlog logs --archived had a way to select the N most recent archived logs. That way, a user who wishes to use grep or looker to search for an event in the current and most-recent-archived log files could run something like:

$ oxlog logs <SVC> --current --last 1 | xargs -L 1 cat | looker

or whatever.

[leftwo]

I've also had luck with sort like this:

/opt/oxide/oxlog/oxlog logs --archived oxz_nexus_65a11c18-7f59-41ac-b9e7-680627f996e7 nexus | sort -t. -k3,3 | tail -n2

That usually gives me the two most recent archived log files, but it relies on the log file path structure being consistent.