需求描述:
日志记录了一次操作的时间,即server端接收包到发送结果到client端的时间,取出操作时间最长的100个记录。
日志信息片段:
[2013-09-13 15:23:50,445.500] [47028700024080] FATAL - socket = 9
[2013-09-13 15:23:50,446.156] [47028700024080] FATAL - a client connected with ip: 10.10.10.127, name: <unknown>, port: 2314
[2013-09-13 15:23:50,447.375] [1103333696] INFO - recv: with 64 bytes from 10.10.10.127.
[2013-09-13 15:23:50,449.461] [1103333696] INFO - send: 1 with 1 bytes.
.........
[root@sjs_131_126 analyse_time]# cat sort.sh
#!/bin/sh #cat $1 | perl split.pl grep -n 'FATAL - socket|INFO - send:' $1 |awk -F']' '{print $1 $3}'|awk -F'[' '{print $1 " "t$2}'> result1.txt echo "result1 success!" ./analyze.pl result1.txt echo "result2 success!" # cat result2.txt | sort -t: -r | head -100 >result.txt echo "success!"
说明:
1.第一步,将开始和结束的日志提取到result1.txt
2.第二步,通过analyze.pl计算每次操作的时间写入result2.txt
3.第三步,排序取出前100条
[root@sjs_131_126 analyse_time]# cat analyze.pl
#!/usr/bin/perl -w use strict; use warnings ; use Time::Local; open FD1, ">> result_error.txt" ; open FD2, ">> result2.txt"; my $need_end = 0; my ($second, $minute, $hour, $date, $month, $year); my $begin = 0; my $end = 0; my $begin_time = 0; my $end_time = 0; #sample #6653: 2013-09-11 15:04:35,815.499 FATAL - socket = 8 #6656: 2013-09-11 15:04:35,821.075 INFO - send: 1 with 1 bytes. while(<>) { chomp ; if($need_end == 0) { if(/(d+): (d+)-(d+)-(d+)s(d+):(d+):(d+),.*s(INFO|FATAL).*/s) { if($8 eq "FATAL") { $begin = $1; $need_end = 1; ($second, $minute, $hour, $date, $month, $year) = ($7, $6, $5, $4, $3 - 1, $2 - 1900); $begin_time = timelocal($second, $minute, $hour, $date, $month, $year); #print "$year-$month-$date $hour:$minute:$second " } else { print FD1 "$_ " ; $need_end = 0 ; } } else { die "match error " ; } } elsif($need_end == 1) { if(/(d+): (d+)-(d+)-(d+)s(d+):(d+):(d+),.*s(INFO|FATAL).*/s) { $end = $1; if( $end == $begin + 3 && $8 eq "INFO") { $end = $1; $need_end = 0; ($second, $minute, $hour, $date, $month, $year) = ($7, $6, $5, $4, $3 - 1, $2 - 1900); $end_time = timelocal($second, $minute, $hour, $date, $month, $year); my $duration = $end_time - $begin_time; print FD2 "$duration:[$begin to $end] "; } else { $need_end = 0 ; print FD1 "$_ " ; } } } else { die "control error " ; } }