Question

我试图找到通过我的系统发送文件所需的时间：我将时间戳记录在两个日志文件中，如下所示：

第一

4824597 1371853829 /home/customer1/ITAM.xml
.
.
.
.
4824597 1371854003 /home/customer46/ITAM.xml

第二

4824597 1371854003 /home/customer1/ITAM.xml
.
.
.
.
4824597 1371854003 /home/customer46/ITAM.xml

以下是我用来减去时间戳的命令。

awk '{
  sub(/:/," ",$2);
  t1=mktime(strftime("%Y %m %d")" "$2" 00");
  getline < "/root/ITAM.txt";
  sub(/:/," ",$2);
  t2=mktime(strftime("%Y %m %d")" "$2" 00");
  print $3": "t2-t1" s"
}' /root/fileSizelog.txt

我现在遇到的问题是我得到了像-7185759这样的奇怪输出。看起来它正在从EPOCH时间做差异。有人可以帮忙吗？

Answer 1

~~你在问题中提到有两个日志文件，即使你只发布了一个。因此，我将以您的输入数据为例，说明如何使用解决方案。~~

根据新的样本数据更新了解决方案。

使用的样本数据：

$ cat first
824597 1371853829 /home/customer1/ITAM.xml
4824597 1371854003 /home/customer46/ITAM.xml

$ cat second
4824597 1371854003 /home/customer1/ITAM.xml
4824597 1371854003 /home/customer46/ITAM.xml

我添加了评论，使其更容易理解。

script.awk的内容：

# This syntax in combination with next (seen below) allows us to work on the first file 
# entirely 

NF==FNR {

# we are indexing the filename and assign it start time value

    start[$3]=$2

# next allows us to skip the rest action statements

    next
}

# once the first log file is looped over we store the second log file in end array

{

    end[$3]=$2
} 

# End block is where we are doing most of our computation since we have scanned 
# through the two files and now are ready to calculate the difference

END {

# we iterate over the start array and pick an index value (that is a file)

    for (filestart in start) {

# we do the same for our second array

        for (fileend in end) {

# if the filename are same then we are ready to do the difference

        if (filestart == fileend) {

# we subtract start time from end time

            diff = end[fileend] - start[filestart];

# we use sprintf function to avoid printing the difference so that we can store it in a variable

            diff = sprintf("%dh:%dm:%ds",diff/(60*60),diff%(60*60)/60,diff%60)

# we print the filename and the time lag

            print filestart,diff

# we delete the filename indices to reduce the size of array for performance reasons

            delete start[filestart]
            delete end[fileend]
            }
        }
    }
}

将脚本作为awk -f script.awk log.file运行或以：

运行

$ awk '        
NR==FNR {
    start[$3]=$2
    next
} 
{
    end[$3]=$2
} 
END {
    for(filestart in start) {
        for(fileend in end) {
            if (filestart == fileend) {
                diff = end[fileend] - start[filestart];
                diff = sprintf("%dh:%dm:%ds",diff/(60*60),diff%(60*60)/60,diff%60)
                print filestart,diff
                delete start[filestart]
                delete end[fileend]
             }
        }
    }
}' first second
/home/customer46/ITAM.xml 0h:0m:0s
/home/customer1/ITAM.xml 0h:2m:54s

如何减去2个日志文件中两个时间戳的差异

1 个答案:

使用的样本数据：

script.awk的内容：