使用gawk写的日志分析器

两年前用于工作需要我用gawk写的解析系统日志的代码,贴出来留着方便回忆gawk语法。

  1#!/usr/bin/gawk
  2
  3BEGIN {
  4    RS="+++"
  5    ast=0; as = 0 ; s = 0; al = 0; au = 0
  6    print "parsering."
  7#    system("./check_core &")
  8    system("rm -f tmp/* && touch tmp/rolling_list && touch tmp/error_list && touch tmp/mem_list && touch tmp/cpu_list && touch tmp/alarm_list && touch tmp/audit_list && touch tmp/assert_list && touch tmp/segv_list && touch tmp/core_list")
  9#    now=strftime("%D",systime())
 10#     print now
 11}
 12
 13############ assert #############
 14$0 ~ /ASSERT/ && $0~/Function Trace:/  {
 15        ast++
 16                num=split($0,a,"\n")
 17                printf("+++")>>"tmp/assert_detail"
 18                for(k=1;k<num;k++){
 19                printf("%s\n",a[k])>>"tmp/assert_detail"
 20                }
 21 
 22                i=1
 23                while($i != "Assert:" && i<30) {
 24                        i++
 25                }
 26                
 27        if($i=="Assert:" ) {
 28            k=i
 29            j=i+1
 30            while(k<40 && $k !~ /Event=/) {
 31                k++
 32            }
 33            list=""
 34            if($k ~ /Event=/) {
 35                            for(;j<k-1;j++) {
 36                                    list=list $j "_"
 37                               }
 38                list=list $(k-1)
 39                while($k !~/\[/ && k<50 ) { k++ }
 40                
 41                if($k~/\[/){
 42                    leng=length($k)
 43                    level=substr($k,2,leng-2)
 44                    assert=sprintf("%s %s",list,level)
 45                    close("tmp/assert_list")
 46                    #print list
 47                    system("grep \"" assert "\" tmp/assert_list | wc -l > tmp/.num" )
 48                                    close("tmp/.num")
 49                                       getline ret1 < "tmp/.num"
 50                                       close("tmp/.num")
 51#                    printf("ret1=%d\n",ret1)
 52                    if(ret1==0)
 53                                    {
 54                                            assert= assert " 1"
 55                                    }
 56                                    else if(ret1==1) {
 57                    #    printf("ret1=%d\n",ret1)
 58                                            close("tmp/assert_list")
 59                                            #system("grep \"" assert "\" tmp/assert_list | awk '{print $4 > \"tmp/.num2\" }'")
 60                        system("grep \"" assert "\" tmp/assert_list | cut -d ' ' -f 3 > tmp/.num2" )
 61                                            close("tmp/.num2")
 62                                               getline numb2 <"tmp/.num2"
 63                                            close("tmp/.num2")
 64                                               numb2++
 65                                       #        printf("numb2=%d\n",numb2)
 66                                            system("sed -e '/" assert "/d' tmp/assert_list > tmp/assert_list0 && mv tmp/assert_list0 tmp/assert_list")
 67                                            assert = assert " " numb2
 68                                    }
 69                                    system("cat /dev/null > tmp/.num")
 70                                     system("cat /dev/null > tmp/.num2")
 71                                       numb2=0
 72                    #assert= assert " " $1 " " $2
 73###########################################################################################################
 74                    #n=128-length(assert)
 75                                 #for(l=0;l<n;l++){
 76                                #    assert = assert " "
 77                                 #}
 78                                printf("%s\n",assert>> "tmp/assert_list"
 79                    printf("assert: %s\n",assert
 80                    assert=""
 81                }
 82            }
 83            list=""
 84                }
 85#        close("tmp/assert_list")
 86        next
 87}
 88
 89######## audit ##########
 90($0 ~ /AUDIT/) {
 91    as++
 92                i=1
 93                while($i != "AUDREPT" && i<30) {
 94                        i++
 95                }
 96 
 97                if($i=="AUDREPT") {
 98                    split($(i+2),err,"=")
 99                    error=err[2]
100                                        audit =sprintf("%s %s",$(i+1),error)
101                                        system("grep " $(i+1" tmp/audit_list | grep " error " | wc -l > tmp/.num" )
102                                        close("tmp/.num")
103                                        getline ret2 < "tmp/.num"
104                                        close("tmp/.num")
105                                        #printf("ret2=%d\n",ret2)
106                                        if(ret2==0)
107                                        {
108                                                audit = audit " 1"
109                                        }
110                                        else if(ret2==1) {
111                                        #        printf("ret2=%d\n",ret2)
112                                                close("tmp/audit_list")
113                                        #        system("grep " $(i+1) " tmp/audit_list | grep " error "| wc -l > tmp/.num2" )
114                                                system("grep \"" $(i+1) "\" tmp/audit_list | grep " error " | cut -d ' ' -f 3 > tmp/.num2" )
115                                                close("tmp/.num2")
116                                                getline numb3 <"tmp/.num2"
117                                                close("tmp/.num2")
118                                                numb3++
119                                        #        printf("numb3=%d\n",numb3)
120                                                system("sed -e '/" audit "/d' tmp/audit_list > tmp/audit_list0 && mv tmp/audit_list0 tmp/audit_list")
121                                                audit = audit " " numb3
122                                        }
123                                        system("cat /dev/null > tmp/.num")
124                                        system("cat /dev/null > tmp/.num2")
125                                        numb3=0
126###########################################################################################################
127                    #audit = audit " " $1 " " $2
128                    #num2=128-length(audit)
129                    #for(j=0;j<num2;j++){
130                    #    audit = audit " "
131                    #}
132                    printf("%s\n",audit ) >>"tmp/audit_list"
133                    printf("audit: %s\n",audit) 
134#                    close("tmp/audit_list")
135                    next 
136        }
137}
138
139########### ALARM ###########
140($0 ~ /ALARM/) {
141        al++
142        num=split($0,a,"\n")
143        printf("+++")>>"tmp/alarm_detail"
144        for(k=1;k<num-1;k++){
145        printf("%s\n",a[k])>>"tmp/alarm_detail"
146        }
147        if(a[num-1~ "Additional") {
148        print a[num-1>>"tmp/alarm_detail"
149    
150        }
151
152        i=1
153        while($i != "Severity") {
154            i++
155        }
156        
157        if($i=="Severity" && $(i+2)!="info" && $(i+2)!="cleared" ) {
158            k=i
159            name=""
160            resource=""
161            while($k!="Name" && k-i<10){k++}
162            if($k=="Name" &&$(k+1)==":"){ 
163                name=$(k+2)
164                t=k
165                while($t!="Resource" && t-k<10){t++}
166                if($t=="Resource"){
167                    resource=$(t+2)
168                }
169                
170                split(resource,res,":")
171                split(res[1],resour,"=")
172                resource=resour[2]
173                alist=sprintf("%s %s %s",name,resource,$(i+2)) 
174                system("grep " name " tmp/alarm_list | grep " resource " | grep " $(i+2" |wc -l > tmp/.num" )
175                close("tmp/.num")
176                getline ret < "tmp/.num"
177                close("tmp/.num")
178                #printf("ret=%d\n",ret)
179                #system("cat /dev/null > tmp/.num")
180                if(ret==|| ret=="0")
181                { 
182                    alist=alist " 1"
183                #    printf("alist=%s\n",alist)
184                }
185                else if(ret==1) {
186                    close("tmp/alarm_list")
187                    system("grep " name " tmp/alarm_list | grep " resource " | grep " $(i+2" | awk '{print $4 > \"tmp/.num2\"}'" )
188                    close("tmp/.num2")
189                    getline numb <"tmp/.num2"
190                    close("tmp/.num2")
191                    numb++
192                    system("sed -e '/" alist "/d' tmp/alarm_list > tmp/alarm_list0 && mv tmp/alarm_list0 tmp/alarm_list")
193                    alist=alist " " numb
194                }    
195#                alist=alist " " $1 " " $2
196#                n=128-length(alist)
197#                for(l=0;l<n;l++){
198#                alist = alist " "
199#                }
200                printf("%s\n",alist) >> "tmp/alarm_list"
201                printf("alarm: %s\n",alist)
202                system("cat /dev/null > tmp/.num")
203                system("cat /dev/null > tmp/.num2")
204                alist=""
205                numb=0
206            }
207        }
208#        close("tmp/alarm_list")
209        next
210    }
211
212
213######## segv #########
214($0 ~ /EXCEPTION/) {
215                i=1
216                while($i != "Task" && i<50) {
217                        i++
218                }
219 
220                if($i=="Task") {
221                                        system("grep " $(i+1" tmp/segv_list | wc -l > tmp/.num" )
222                                        close("tmp/.num")
223                                        getline ret2 < "tmp/.num"
224                                        close("tmp/.num")
225                                        if(ret2==0)
226                                        {
227                                                segv = segv " 1"
228                                        }
229                                        else if(ret2==1) {
230                                                close("tmp/segv_list")
231                                                #system("grep " $(i+1) " tmp/segv_list | wc -l > tmp/.num2" )
232                                                system("grep \"" $(i+1) "\" tmp/segv_list | cut -d ' ' -f 3 > tmp/.num2" )
233                                                close("tmp/.num2")
234                                                getline numb3 <"tmp/.num2"
235                                                close("tmp/.num2")
236                                                numb3++
237                                                system("sed -e '/" segv "/d' tmp/segv_list > tmp/segv_list0 && mv tmp/segv_list0 tmp/segv_list")
238                                                segv = segv " " numb3
239                                        }
240                                        system("cat /dev/null > tmp/.num")
241                                        system("cat /dev/null > tmp/.num2")
242                                        numb3=0
243                                        printf("%s\n",segv ) >>"tmp/segv_list"
244                                        printf("segv: %s\n",segv)
245                                        next
246                }
247}
248
249
250##########################################################################################################
251($4 ~ /HIGH/ && ($6 ~ /ngss/ || $6 ~ /h248ds/ || $6 ~ /fs5000/ || $6 ~/ss7/)) {
252                
253                if($11 ~ "A-" || $11 ~ "C-") {
254                    num=split($6,a,":")
255                    app=a[1]
256                    nu=split($11,b,":")
257                    num=split(b[1],c,"-")
258                    shelf= "s0" c[2]
259                    if (b[2< 10)
260                        card= "c0" b[2]
261                    else
262                        card= "c" b[2]
263                    host= "h" b[3]
264                    machine=shelf card host
265                    if (app=="ngss")
266                        app= "NGSS"
267                    else if (app=="fs5000")
268                        app= "CTS"
269                    else if (app=="h248ds")
270                        app= "H248DS"
271                    else if (app=="ss7")
272                        app="SS7"
273                    rolling=sprintf("%s %s",app,machine)
274                    close("tmp/.num")
275                    system("grep " machine " tmp/rolling_list | grep " app " tmp/rolling_list  | wc -l > tmp/.num" )
276                                        close("tmp/.num")
277                                        getline high_ret < "tmp/.num"
278                                        close("tmp/.num")
279                                        if(high_ret==0)
280                                        {
281                                                rolling = rolling " 1"
282                                        }
283                                        else {
284                                                close("tmp/rolling_list")
285                                                system("grep " machine " tmp/rolling_list | grep " app " tmp/rolling_list  | cut -d ' ' -f 3 > tmp/.num2" )
286                                                close("tmp/.num2")
287                        numb=0
288                                                getline numb <"tmp/.num2"
289                                                close("tmp/.num2")
290                                                numb++
291                                                system("sed -e '/" rolling "/d' tmp/rolling_list > tmp/rolling_list0 && mv tmp/rolling_list0 tmp/rolling_list")
292                                                rolling = rolling " " numb
293                                        }
294                                        system("cat /dev/null > tmp/.num")
295                                        system("cat /dev/null > tmp/.num2")
296                                        numb=0
297                    close("tmp/rolling_list")
298                                        printf("%s\n",rolling) >>"tmp/rolling_list"
299                    system("sort tmp/rolling_list > rolling_list0 && mv rolling_list0 rolling_list")
300                                        printf("rolling: %s\n",rolling)
301                                        next
302                }
303}
304############################################################################################################
305
306($0 ~ /error/ || $0 ~ /Error/ || $0 ~ /ERROR/ ) {
307 
308                if($11 ~ "A-" || $11 ~ "C-") {
309                                        nu=split($11,b,":")
310                                        num=split(b[1],c,"-")
311                                        shelf= "s0" c[2]
312                                        if (b[2< 10)
313                                                card= "c0" b[2]
314                                        else
315                                                card= "c" b[2]
316                                        host= "h" b[3]
317                                        machine=shelf card host
318                                        error=sprintf("Error %s",machine)
319                                        close("tmp/.num")
320                                        system("grep Error tmp/error_list | grep " machine " tmp/error_list | wc -l > tmp/.num" )
321                                        close("tmp/.num")
322                                        getline high_ret < "tmp/.num"
323                                        close("tmp/.num")
324                                        if(high_ret==0)
325                                        {
326                                                error = error " 1"
327                                        }
328                                        else {
329                                                close("tmp/error_list")
330                                                system("grep Error tmp/error_list | grep " machine " tmp/error_list | cut -d ' ' -f 3 > tmp/.num2" )
331                                                close("tmp/.num2")
332                                                numb=0
333                                                getline numb <"tmp/.num2"
334                                                close("tmp/.num2")
335                                                numb++
336                                                system("sed -e '/" error "/d' tmp/error_list > tmp/error_list0 && mv tmp/error_list0 tmp/error_list")
337                                                error = error " " numb
338                                        }
339                                        system("cat /dev/null > tmp/.num")
340                                        system("cat /dev/null > tmp/.num2")
341                                        numb=0
342                                        close("tmp/error_list")
343                                        printf("%s\n",error) >>"tmp/error_list"
344                                        system("sort tmp/error_list > error_list0 && mv error_list0 error_list")
345                                        printf("rolling: %s\n",error)
346                                        next
347                }
348 
349}
350##########################################################################################################
351($0 ~ /fail/ || $0 ~ /Fail/ || $0 ~ /FAIL/ ) {
352 
353                if($11 ~ "A-" || $11 ~ "C-") {
354                                        nu=split($11,b,":")
355                                        num=split(b[1],c,"-")
356                                        shelf= "s0" c[2]
357                                        if (b[2< 10)
358                                                card= "c0" b[2]
359                                        else
360                                                card= "c" b[2]
361                                        host= "h" b[3]
362                                        machine=shelf card host
363                                        error=sprintf("Fail %s",machine)
364                                        close("tmp/.num")
365                                        system("grep Fail tmp/error_list | grep " machine " tmp/error_list | wc -l > tmp/.num" )
366                                        close("tmp/.num")
367                                        getline high_ret < "tmp/.num"
368                                        close("tmp/.num")
369                                        if(high_ret==0)
370                                        {
371                                                error = error " 1"
372                                        }
373                                        else {
374                                                close("tmp/error_list")
375                                                system("grep Fail tmp/error_list | grep " machine " tmp/error_list | cut -d ' ' -f 3 > tmp/.num2" )
376                                                close("tmp/.num2")
377                                                numb=0
378                                                getline numb <"tmp/.num2"
379                                                close("tmp/.num2")
380                                                numb++
381                                                system("sed -e '/" error "/d' tmp/error_list > tmp/error_list0 && mv tmp/error_list0 tmp/error_list")
382                                                error = error " " numb
383                                        }
384                                        system("cat /dev/null > tmp/.num")
385                                        system("cat /dev/null > tmp/.num2")
386                                        numb=0
387                                        close("tmp/error_list")
388                                        printf("%s\n",error) >>"tmp/error_list"
389                                        system("sort tmp/error_list > error_list0 && mv error_list0 error_list")
390                                        printf("rolling: %s\n",error)
391                                        next
392                }
393}
394
395#########################################################################################################
396($0 ~ /sw_rcvy/ || $0 ~ /SW_RCVY/ ) {
397 
398                if($11 ~ "A-" || $11 ~ "C-") {
399                                        nu=split($11,b,":")
400                                        num=split(b[1],c,"-")
401                                        shelf= "s0" c[2]
402                                        if (b[2< 10)
403                                                card= "c0" b[2]
404                                        else
405                                                card= "c" b[2]
406                                        host= "h" b[3]
407                                        machine=shelf card host
408                                        error=sprintf("SW_RCVY %s",machine)
409                                        close("tmp/.num")
410                                        system("grep SW_RCVY tmp/error_list | grep " machine " tmp/error_list | wc -l > tmp/.num" )
411                                        close("tmp/.num")
412                                        getline high_ret < "tmp/.num"
413                                        close("tmp/.num")
414                                        if(high_ret==0)
415                                        {
416                                                error = error " 1"
417                                        }
418                                        else {
419                                                close("tmp/error_list")
420                                                system("grep SW_RCVY tmp/error_list | grep " machine " tmp/error_list | cut -d ' ' -f 3 > tmp/.num2" )
421                                                close("tmp/.num2")
422                                                numb=0
423                                                getline numb <"tmp/.num2"
424                                                close("tmp/.num2")
425                                                numb++
426                                                system("sed -e '/" error "/d' tmp/error_list > tmp/error_list0 && mv tmp/error_list0 tmp/error_list")
427                                                error = error " " numb
428                                        }
429                                        system("cat /dev/null > tmp/.num")
430                                        system("cat /dev/null > tmp/.num2")
431                                        numb=0
432                                        close("tmp/error_list")
433                                        printf("%s\n",error) >>"tmp/error_list"
434                                        system("sort tmp/error_list > error_list0 && mv error_list0 error_list")
435                                        printf("rolling: %s\n",error)
436                                        next
437                }
438 
439}
440
441###########################################################################################################
442END {
443#    printf("%d\n",as)>>"tmp/assert_list";
444    close("assert_list")
445    close("assert_detail")
446    close("tmp/.num")
447    close("segv_list")
448    close("alarm_list")
449    close("alarm_detail")
450    close("audit_list")
451    close("rolling_list")
452    close("error_list")
453    close("core_list")
454    print "done!"
455}
456

posted on 2010-12-09 15:15 挑灯看剑 阅读(387) 评论(0)  编辑 收藏 引用 所属分类: 工作随笔

只有注册用户登录后才能发表评论。
<2010年8月>
25262728293031
1234567
891011121314
15161718192021
22232425262728
2930311234

导航

公告

【自我介绍】 08年南开大学硕士毕业 最近关注:算法、Linux、c++、高并发 爱好:滑旱冰、打乒乓球、台球、保龄球

常用链接

随笔分类(139)

文章分类

我常去的网站

技术博客(都是大牛)

技术站点

搜索

积分与排名