☰

提取日志

tag-icon • tag-icon linux text-processing
提取日志

问题是当我运行此命令时，它不会显示完整的 IP 地址，即137.244.209.141。提取正确此信息的方法是什么？

随机日志：

2016-08-08 14:24:24 [480879] 1bWgnG-00215x-Li ** [email protected] F=<[email protected]> P=<[email protected]> R=lookuphost T=remote_smtp H=mx3.hotmail.com [65.55.33.119]:25 I=[137.244.209.141]:32899 X=TLSv1.2:ECDHE-RSA-AES256-SHA384:256 CV=yes DN="/CN=*.hotmail.com": SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=52485: 550 SC-001 (COL004-MC5F14) Unfortunately, messages from 137.244.209.141 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.
2016-08-08 14:24:38 [481047] 1bWgnT-00211m-SS ** [email protected] ([email protected]) <[email protected]> F=<[email protected]> P=<[email protected]> R=lookuphost T=remote_smtp H=mx3.hotmail.com [65.54.188.72]:25 I=[137.244.209.141]:59328 X=TLSv1.2:ECDHE-RSA-AES256-SHA384:256 CV=yes DN="/CN=*.hotmail.com": SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=19825: 550 SC-001 (BAY004-MC1F33) Unfortunately, messages from 137.244.209.141 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

从日志中提取数据的命令：

sed -nE 's,^([-0-9]{10})[^@]* ([^@]*@[^[:space:]]*)[^=]*F=<([^@]*@[^[:space:]]*)>.*SIZE=[^[:space:]]* (... ..-...) .*([[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+).*,\1    \2    \3  \5    \4,p' logs | column -t

输出：

2016-08-08  [email protected]   [email protected]          7.244.209.141  550  SC-001
2016-08-08  [email protected]  [email protected]  7.244.209.141  550  SC-001

答案1

问题可能是位于您的.*IP 地址匹配项前面的 是贪婪的，因此它将在您的字符串中尽可能多地匹配。

.*([[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+).*,

您需要修改第一个.*以停在数字边界处。我会建议某物像这样可能有效，但我只针对您的示例exim4数据对其进行了测试

.*[^[:digit:]]

修改后的输出

2016-08-08  [email protected]   [email protected]          137.244.209.141  550  SC-001
2016-08-08  [email protected]  [email protected]  137.244.209.141  550  SC-001

相关内容