☰

如何在给定字符串之后 grep 字符串

tag-icon • tag-icon grep logs
如何在给定字符串之后 grep 字符串

我有一个日志文件 myfile.log 其内容如下

Thu Jun 04 09:02:05 2020
Closing scheduler window
Closing Resource Manager plan via scheduler window
Clearing Resource Manager plan at database via parameter
Thu Jun 04 09:22:50 2020
mystring3: APP failed to died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
Thu Jun 04 09:32:20 2020
Incremental point up to RBA [0x5a5f.43feb8.0], current log tail at RBA [0x5a5f.44d433.0]
Thu Jun 04 09:39:54 2020
mystring3: APP failed died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
Thu Jun 04 09:51:12 2020
mystring1: APP failed check failed to cache
object handle. Error code: 1014
APP connection lost, closing wallet
Thu Jun 04 09:51:18 2020
Errors in file /folder1/folder2/folder3/file.log:
Err-9087: cpu time or run time policy violation
Thu Jun 04 09:52:07 2020
Dumping diagnostic data in directory=[cdmp_20200604095207], requested by (instance=8, osid=313861), summary=[incident=969964].
Thu Jun 04 10:02:24 2020
Incremental point up to RBA [0x5a5f.48846c.0], current log tail at RBA [0x5a5f.4a1de0.0]
TABLE SYS.USER: ADDED INTERVAL PARTITION SYS_P3375 (3814) VALUES LESS THAN (TO_DATE(' 2020-06-11 01:00:00', 'SYYYY-MM-DD HH24:MI:SS', 'CAL=GREGORIAN'))

我 grep "mystring" 并以这种格式获取几行：

grep -B1 -A2 mystring myfile.log | grep -B1 -A2 mystring myfile.log | grep -B1 -A2 mystring myfile.log | grep "2009 年 6 月 4 日"-A3

Thu Jun 04 09:22:50 2020
mystring3: APP failed to died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
--
Thu Jun 04 09:39:54 2020
mystring3: APP failed died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
--
Thu Jun 04 09:51:12 2020
mystring1: APP failed check failed to cache
object handle. Error code: 1014
APP connection lost, closing wallet

但我想获取以下格式的行，其中我需要具有带有上述时间戳的“增量点”的行。我可以将“行后参数”（-A2）增加到（-A5），但是如何在同一 grep 命令中获取具有名称的字符串，这样如果它发生在多次之后，它就不会错过“增量点”字符串的行来自我的搜索字符串或给定时间范围的行（2009 年 6 月 4 日）

Thu Jun 04 09:22:50 2020
mystring3: APP failed to died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
Thu Jun 04 09:32:20 2020
Incremental point up to RBA [0x5a5f.43feb8.0], current log tail at RBA [0x5a5f.44d433.0]
--
Thu Jun 04 09:39:54 2020
mystring3: APP failed died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
--
Thu Jun 04 09:51:12 2020
mystring1: APP failed check failed to cache
object handle. Error code: 1014
APP connection lost, closing wallet
Thu Jun 04 10:02:24 2020
Incremental point up to RBA [0x5a5f.48846c.0], current log tail at RBA [0x5a5f.4a1de0.0]

答案1

试试这个，我想这对你有用：

$ awk -v d="Jun 04 09" 'BEGIN { n=1;i=1;start=0;split(d,mon);extrahour=mon[1]" "mon[2]" "mon[3]+1;}

/mystring/ { if (i==1 && start == 1 ){ n=split(a,b,"\n");for (j=1;j<n;j++) print b[j];a="";  }

if (start == 1) { print "-----\n"l"\n"$0;n=2;i=1;next} }

/^Incremental/ { if (start==1) { print a"\n"$0;a="";n=1;i=0; }}

{ if( $0 ~ d )start=1; if ( $0 ~ mon[1] &&  ( $0 !~ d && $0 !~ extrahour ) ) {start=0;} 

  if ( start==1 ) {  l=$0; if (n==2) a=a"\n"$0  }

 } ' file | sed /^$/d

-----
Thu Jun 04 09:22:50 2020
mystring3: APP failed to died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
Thu Jun 04 09:32:20 2020
Incremental point up to RBA [0x5a5f.43feb8.0], current log tail at RBA [0x5a5f.44d433.0]
-----
Thu Jun 04 09:39:54 2020
mystring3: APP failed died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
-----
Thu Jun 04 09:51:12 2020
mystring1: APP failed check failed to cache
object handle. Error code: 1014
APP connection lost, closing wallet
Thu Jun 04 09:51:18 2020
Errors in file /folder1/folder2/folder3/file.log:
Err-9087: cpu time or run time policy violation
Thu Jun 04 09:52:07 2020
Dumping diagnostic data in directory=[cdmp_20200604095207], requested by (instance=8, osid=313861), summary=[incident=969964].
Thu Jun 04 10:02:24 2020
Incremental point up to RBA [0x5a5f.48846c.0], current log tail at RBA [0x5a5f.4a1de0.0]

答案2

$ awk -v searchstring=mystring 'print_line; '\
'/^Incremental point/ { print_line=0; print ""; print "------------"; print ""; next; }; '\
'$0 ~ "^" searchstring { print; print_line=1; }' input

mystring3: APP failed to died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
Thu Jun 04 09:32:20 2020
Incremental point up to RBA [0x5a5f.43feb8.0], current log tail at RBA [0x5a5f.44d433.0]

------------

mystring3: APP failed died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
Thu Jun 04 09:51:12 2020
mystring1: APP failed check failed to cache
mystring1: APP failed check failed to cache
object handle. Error code: 1014
APP connection lost, closing wallet
Thu Jun 04 09:51:18 2020
Errors in file /folder1/folder2/folder3/file.log:
Err-9087: cpu time or run time policy violation
Thu Jun 04 09:52:07 2020
Dumping diagnostic data in directory=[cdmp_20200604095207], requested by (instance=8, osid=313861), summary=[incident=969964].
Thu Jun 04 10:02:24 2020
Incremental point up to RBA [0x5a5f.48846c.0], current log tail at RBA [0x5a5f.4a1de0.0]

------------

相关内容