☰

获取最近5秒的所有文件列表

tag-icon • tag-icon text-processing awk logs
获取最近5秒的所有文件列表

您好将从命令提示符中获取行列表，如下所示。

完成logread并应用一些过滤器后

Sat Sep 9 07:28:18 2017 notifications.google.com 192.168.150.201
Sat Sep 9 07:29:18 2017 notifications.google.com 192.168.150.201
Sat Sep 9 07:31:19 2017 plus.l.google.com 192.168.150.201
Sat Sep 9 07:34:19 2017 plus.l.google.com 192.168.150.201
Sat Sep 9 07:34:53 2017 mail.google.com fe80::dc5f:57fd:640c:6661
Sat Sep 9 07:34:53 2017 mail.google.com 192.168.150.128
Sat Sep 9 07:35:53 2017 www.google.com fe80::dc5f:57fd:640c:6661
Sat Sep 9 07:37:53 2017 www.google.com 192.168.150.128
Sat Sep 9 07:37:40 2017 24-courier.push.apple.com 192.168.150.182
Sat Sep 9 07:38:40 2017 www-cdn.icloud.com.akadns.net 192.168.150.182
Sat Sep 9 07:38:40 2017 e6858.dsce9.akamaiedge.net 192.168.150.182
Sat Sep 9 07:38:40 2017 origin.guzzoni-apple.com.akadns.net 192.168.150.182
Sat Sep 9 07:39:46 2017 beacons.gcp.gvt2.com fe80::dc5f:57fd:640c:6661
Sat Sep 9 07:40:46 2017 beacons.gcp.gvt2.com 192.168.150.128

现在我想获取最近5秒更改记录的唯一记录

运行过滤器命令后，我需要以下格式

我本可以这样做logread|awk '$4 > "07:35:00"'，但问题是我总是需要打发时间。我有类似的东西> '5 seconds'，这样我就可以得到以下内容：

Sat Sep 9 07:37:53 2017 www.google.com 192.168.150.128
    Sat Sep 9 07:37:40 2017 24-courier.push.apple.com 192.168.150.182
    Sat Sep 9 07:38:40 2017 www-cdn.icloud.com.akadns.net 192.168.150.182
    Sat Sep 9 07:38:40 2017 e6858.dsce9.akamaiedge.net 192.168.150.182
    Sat Sep 9 07:38:40 2017 origin.guzzoni-apple.com.akadns.net 192.168.150.182
    Sat Sep 9 07:39:46 2017 beacons.gcp.gvt2.com fe80::dc5f:57fd:640c:6661
    Sat Sep 9 07:40:46 2017 beacons.gcp.gvt2.com 192.168.150.128

答案1

如何使用请参见“测试”部分。

#!/bin/bash

# select only dates - five columns from the beginning
dates_only=$(cut -d ' ' -f 1-5 "$2")

# the last date is taking - we will calculate the lower time limit from it.
last_line_time=$(tail -n 1 <(echo "$dates_only"))

# generate the unix time (the amount of seconds from 1970) for
# the each date. It will be the additional column in the next.
dates_to_unix_fmt=$(date '+%s' -f <(echo "$dates_only"))

# find the unix time for the last line time.
print_from=$(date '+%s' -d "${last_line_time} - $1")

# adding the unix time in the beginning of the each line.
# it will be removed in the end by the awk.
paste <(printf "%s\n" $dates_to_unix_fmt) "$2" |
awk -v from="$print_from" '$1 > from {sub(/.*\t/, ""); print;}'

测试

输入（添加了几行 - 用于测试）

Sat Sep 9 07:28:18 2017 notifications.google.com 192.168.150.201
Sat Sep 9 07:29:18 2017 notifications.google.com 192.168.150.201
Sat Sep 9 07:31:19 2017 plus.l.google.com 192.168.150.201
Sat Sep 9 07:34:19 2017 plus.l.google.com 192.168.150.201
Sat Sep 9 07:34:53 2017 mail.google.com fe80::dc5f:57fd:640c:6661
Sat Sep 9 07:34:53 2017 mail.google.com 192.168.150.128
Sat Sep 9 07:35:53 2017 www.google.com fe80::dc5f:57fd:640c:6661
Sat Sep 9 07:37:53 2017 www.google.com 192.168.150.128
Sat Sep 9 07:37:40 2017 24-courier.push.apple.com 192.168.150.182
Sat Sep 9 07:38:40 2017 www-cdn.icloud.com.akadns.net 192.168.150.182
Sat Sep 9 07:38:40 2017 e6858.dsce9.akamaiedge.net 192.168.150.182
Sat Sep 9 07:38:40 2017 origin.guzzoni-apple.com.akadns.net 192.168.150.182
Sat Sep 9 07:39:46 2017 beacons.gcp.gvt2.com fe80::dc5f:57fd:640c:6661
Sat Sep 9 07:40:36 2017 beacons.gcp.gvt2.com 192.168.150.128
Sat Sep 9 07:40:41 2017 beacons.gcp.gvt2.com 192.168.150.128
Sat Sep 9 07:40:46 2017 beacons.gcp.gvt2.com 192.168.150.128

输出

$ ./time_range.sh "10 sec" input.txt 
Sat Sep 9 07:40:41 2017 beacons.gcp.gvt2.com 192.168.150.128
Sat Sep 9 07:40:46 2017 beacons.gcp.gvt2.com 192.168.150.128

$ ./time_range.sh "20 second" input.txt 
Sat Sep 9 07:40:36 2017 beacons.gcp.gvt2.com 192.168.150.128
Sat Sep 9 07:40:41 2017 beacons.gcp.gvt2.com 192.168.150.128
Sat Sep 9 07:40:46 2017 beacons.gcp.gvt2.com 192.168.150.128

$ ./time_range.sh "4 min" input.txt 
Sat Sep 9 07:37:53 2017 www.google.com 192.168.150.128
Sat Sep 9 07:37:40 2017 24-courier.push.apple.com 192.168.150.182
Sat Sep 9 07:38:40 2017 www-cdn.icloud.com.akadns.net 192.168.150.182
Sat Sep 9 07:38:40 2017 e6858.dsce9.akamaiedge.net 192.168.150.182
Sat Sep 9 07:38:40 2017 origin.guzzoni-apple.com.akadns.net 192.168.150.182
Sat Sep 9 07:39:46 2017 beacons.gcp.gvt2.com fe80::dc5f:57fd:640c:6661
Sat Sep 9 07:40:36 2017 beacons.gcp.gvt2.com 192.168.150.128
Sat Sep 9 07:40:41 2017 beacons.gcp.gvt2.com 192.168.150.128
Sat Sep 9 07:40:46 2017 beacons.gcp.gvt2.com 192.168.150.128

$ ./time_range.sh "2 minute" input.txt 
Sat Sep 9 07:39:46 2017 beacons.gcp.gvt2.com fe80::dc5f:57fd:640c:6661
Sat Sep 9 07:40:36 2017 beacons.gcp.gvt2.com 192.168.150.128
Sat Sep 9 07:40:41 2017 beacons.gcp.gvt2.com 192.168.150.128
Sat Sep 9 07:40:46 2017 beacons.gcp.gvt2.com 192.168.150.128

答案2

dat=$(date -d -5sec +%T)
logread|awk -v dat=$dat '$4 > dat'

将 dat 设置为 5 秒前的时间，然后将其作为变量传递给 awk。

相关内容