Question

编辑：

Text1.txt:
123.456.789.189:12345
222.222.222.444:56789
451.200.111.321:55555
333.333.333.111:11223

我想将ID与未注册的IP进行比较。

ERROR：

Exception calling "Add" with "2" argument(s): "Item has already been added. Key in dictionary: '123.456.789.189:12345'  Key being added: '123.456.789.189:12345'" +     $nameHash.Add( $data3[4], $data3[3] )

我认为这个错误是由于重复的存在。

如何解决哈希表中重复项的问题？

我计算时间的功能包括开始日期和结束日期。

Function calTimeDiff( $StartDate, $EndDate ) 
{
    "which is = " + (NEW-TIMESPAN –Start $StartDate –End $EndDate).Hours + " hours, " + 
    (NEW-TIMESPAN –Start $StartDate –End $EndDate).Minutes + " minutes, " + 
    (NEW-TIMESPAN –Start $StartDate –End $EndDate).Seconds + " seconds, " + 
    "diff = " + (NEW-TIMESPAN –Start $StartDate –End $EndDate).TotalSeconds + " sec"
}

$lines1 = Get-Content "C:\Temp\Text1.txt" | Select-Object -Unique
$lines2 = Get-Content "C:\Temp\Text2.txt" | Select-Object -Unique

ForEach( $line2 in $lines2 )
{    
    $list = ( $date, $time, $client, $clientIP )
    $list = $line2.Split( "" )
    ForEach( $line1 in $lines1 )
    {
        $disconnectIP = $line1

        If( $disconnectIP -match $list[3] )
        {  
           $date = $list[0]
           $time = $list[1]
           $client = $list[2]
           $clientIP = $list[3] 

           If( $client -eq "serviceClient" )
           {
                $start = $date + " " + $time
           }

           If( $client -eq "Unregistered" )
           {
                $end = $date + " " + $time
           }

           calTimeDiff $start $end 
        }        
    }
}

Answer 1

这些方面的内容怎么样？我认为它基本上表现得像你要求的那样（尽管你可能想稍微调整一下显示范围功能......）

#requires -Version 3
function parse-log 
{
    param(
        [string]$line
    )

    $data = $line.split(' ')
    $dateString = '{0} {1}' -f $data[0], $data[1]
    $timeStamp = Get-Date -Date $dateString
    [pscustomobject]@{
        TimeStamp = $timeStamp
        Client    = $data[2]
        IPAddress = $data[3]
    }
}

function display-span
{
    param(
        $logSpan
    )

    '{0} ({1}) ==> {2}' -f $logSpan.IPAddress, $nameHash.Get_Item( $logSpan.IPAddress), $logSpan.Start
    '{0} ({1}) ==> {2}' -f $logSpan.IPAddress, $nameHash.Get_Item( $logSpan.IPAddress), $logSpan.End
    'Start = {0}, End = {1}, diff = {2}' -f $logSpan.Start, $logSpan.End, $logSpan.TimeSpan
    ''
}

$ipStateHash = @{}
$nameHash = @{}
$logArray = @()

$lines1 = Get-Content -Path '.\Text1.txt'
$lines2 = Get-Content -Path '.\Text2.txt'
$lines3 = Get-Content -Path '.\Text3.txt'

# Build Name Hash
foreach( $line3 in $lines3 )
{
    $data3 = $line3.Split( ' ' )
    $nameHash.Add( $data3[4], $data3[3] )
}

foreach( $line2 in $lines2 ) 
{
    $entry = parse-log -line $line2
    switch( $entry.Client ) {
        'serviceClient' 
        {
            if( $lines1 -contains $entry.IPAddress ) 
            { 
                if( $ipStateHash.ContainsKey( $entry.IPAddress ) -eq $false ) 
                {
                    $ipStateHash.Add( $entry.IPAddress, $entry.TimeStamp )
                }
            }
        }
        'Unregistered' 
        {
            if( $ipStateHash.ContainsKey( $entry.IPAddress ) -eq $true ) 
            {
                $start = $ipStateHash.Get_Item( $entry.IPAddress )
                $ipStateHash.Remove( $entry.IPAddress )
                $timespan = $entry.TimeStamp - $start

                $logArray += [pscustomobject]@{
                    IPAddress = $entry.IPAddress
                    Start     = $start
                    End       = $entry.TimeStamp
                    TimeSpan  = $timespan
                }
            }
        }
    }
}

$logArray | ForEach-Object -Process {
    display-span -logSpan $_ 
}

"IPs that weren't Unregistered:"
$ipStateHash.GetEnumerator() | Sort-Object -Property TimeStamp | ForEach-Object -Process {
    '{0} ==> {1}' -f $nameHash.Get_Item( $_.Key ), $_.Value 
}

使用上面更新的数据文件，脚本输出：

123.456.789.189:12345 (BOB) ==> 7/29/2015 6:00:13 AM
123.456.789.189:12345 (BOB) ==> 7/29/2015 6:00:19 AM
Start = 7/29/2015 6:00:13 AM, End = 7/29/2015 6:00:19 AM, diff = 00:00:06

222.222.222.444:56789 (ALICE) ==> 7/29/2015 6:00:18 AM
222.222.222.444:56789 (ALICE) ==> 7/29/2015 6:00:22 AM
Start = 7/29/2015 6:00:18 AM, End = 7/29/2015 6:00:22 AM, diff = 00:00:04

451.200.111.321:55555 (TOM) ==> 7/29/2015 6:20:03 AM
451.200.111.321:55555 (TOM) ==> 7/29/2015 6:21:19 AM
Start = 7/29/2015 6:20:03 AM, End = 7/29/2015 6:21:19 AM, diff = 00:01:16

IPs that weren't Unregistered:
BOB ==> 7/29/2015 6:01:00 AM

使用基于linux代码的Powershell计算日志文件中的时间差

1 个答案: