我使用以下命令对 voip 流量进行 tcpdump:
tcpdump -nn port 5060 -i eth0 | grep 'xxx.xxx.xxx.xxx.5060: SIP: SIP/2.0 5'
并得到类似的东西:
11:10:03.600493 IP xxx.xxx.xxx.xxx.5060 > yyy.yyy.yyy.yyy.5060: SIP: SIP/2.0 500 Server Internal Error
11:10:03.610092 IP xxx.xxx.xxx.xxx.5060 > yyy.yyy.yyy.yyy.5060: SIP: SIP/2.0 500 Server Internal Error
11:10:03.860551 IP xxx.xxx.xxx.xxx.5060 > yyy.yyy.yyy.yyy.5060: SIP: SIP/2.0 500 Server Internal Error
11:10:04.190145 IP xxx.xxx.xxx.xxx.5060 > yyy.yyy.yyy.yyy.5060: SIP: SIP/2.0 504 Server Time-out
11:10:04.510174 IP xxx.xxx.xxx.xxx.5060 > yyy.yyy.yyy.yyy.5060: SIP: SIP/2.0 500 Server Internal Error
11:10:04.870164 IP xxx.xxx.xxx.xxx.5060 > yyy.yyy.yyy.yyy.5060: SIP: SIP/2.0 500 Server Internal Error
11:10:06.010196 IP xxx.xxx.xxx.xxx.5060 > yyy.yyy.yyy.yyy.5060: SIP: SIP/2.0 500 Server Internal Error
11:10:07.039787 IP xxx.xxx.xxx.xxx.5060 > yyy.yyy.yyy.yyy.5060: SIP: SIP/2.0 503 Service Unavailable
11:10:07.330243 IP xxx.xxx.xxx.xxx.5060 > yyy.yyy.yyy.yyy.5060: SIP: SIP/2.0 500 Server Internal Error
11:10:08.520721 IP xxx.xxx.xxx.xxx.5060 > yyy.yyy.yyy.yyy.5060: SIP: SIP/2.0 500 Server Internal Error
11:10:08.720207 IP xxx.xxx.xxx.xxx.5060 > yyy.yyy.yyy.yyy.5060: SIP: SIP/2.0 503 Service Unavailable
如何实时获取当前秒内此类行的计数?即如果现在是 11:10:08 我会得到 2 。
答案1
实时解决方案,如原始帖子中所述。
将以下代码保存为脚本并使其可执行:
#!/bin/bash
current_sec=0
while read line
do
prev_sec=$current_sec
current_sec=${line:0:8}
if [ "$current_sec" == "$prev_sec" ]
then
line_count=$((line_count+1))
else
echo $prev_sec /// $line_count
line_count=1
fi
done
然后运行:
tcpdump -nn port 5060 -i eth0 | grep 'xxx.xxx.xxx.xxx.5060: SIP: SIP/2.0 5' | saved_script.sh
这将实时打印:
13:29:50 /// 0
13:29:51 /// 4
13:29:52 /// 9
13:29:54 /// 2
我没有对这段代码进行足够的测试,可能存在错误,但你可以自己测试一下。
答案2
我获取最后一次日志的日期,然后查找它,添加手表,我相信这就是您所需要的。
somefile - 是你的日志文件
grep $(tail -1 somefile | awk -F . '{print $1}') somefile
watch -n1 "grep $(tail -1 somefile | awk -F . '{print $1}') somefile"
答案3
假设文件已排序:
grep -oP "^[0-2][0-9]:[0-2][0-9]:[0-2][0-9]" inputfile | uniq -c
将返回每一整秒的条目数。
3 11:10:03
3 11:10:04
1 11:10:06
2 11:10:07
2 11:10:08