Question

我制作了一些脚本来安排文件的输出并打印第一个字段，如下所示：15:23:30。

我尝试通过将第一个字段的每个部分相乘以将其转换为秒来转换第一个字段，然后在每两行之间进行减法，但我不能将每一行作为参数在每个部分之间进行操作两行。

for rec in $(cut -d " " -f2 file.txt | uniq -d); do
   grep -- "$rec" file.txt done |
awk '{split($0,a," "); print a[1] }'

输入文件类似于/ var / log / messages

May 27 02:43:40 Rolly NetworkManager[2411]: <info> (eth0): DHCPv4 state changed renew -> renew
May 27 02:43:40 Rolly NetworkManager[2411]: <info>   address 192.168.159.133
May 27 02:43:40 Rolly NetworkManager[2411]: <info>   prefix 24 (255.255.255.0)
May 27 02:43:40 Rolly NetworkManager[2411]: <info>   gateway 192.168.159.2
May 27 02:43:40 Rolly NetworkManager[2411]: <info>   nameserver '192.168.159.2'
May 27 02:43:40 Rolly NetworkManager[2411]: <info>   domain name 'localdomain'
May 27 02:56:55 Rolly dhclient[2481]: DHCPREQUEST on eth0 to 192.168.159.254 port 67 (xid=0x3bb3abec)
May 27 02:56:55 Rolly dhclient[2481]: DHCPACK from 192.168.159.254 (xid=0x3bb3abec)
May 27 02:56:55 Rolly dhclient[2481]: bound to 192.168.159.133 -- renewal in 795 seconds.
May 27 02:56:55 Rolly NetworkManager[2411]: <info> (eth0): DHCPv4 state changed renew -> renew

并且所需的输出应该是时间列然后对它的某些行进行一些操作

我想得到类似

的输出

1m 25s

并且如果我可以通过减去转换时间的2个值来获得某些过程的持续时间

Answer 1

我写了以下awk脚本：

# initiate mapping array "Jan"->"01", "Feb"->"02", etc.
BEGIN {
    # assume all dates are from the current year
    YYYY = strftime("%Y", systime())

    # use first day of the month to extract month abbreviations
    # Note: Any day from "01" to "28" would work here.
    DD = "01"

    # use midnight as time for month abbreviation extraction
    # Note: Any (valid) time would work here.
    HH = "00"
    MM = HH
    SS = MM

    # assemble time string ("MM HH SS" format)
    timestr = MM " " HH " " SS

    # iterate over all months
    for (month = 1; month <= 12; ++month) {

        # convert month number to two-digit string ("MM" format)
        MM = sprintf("%02i", month)

        # assemble date string ("YYYY MM DD" format)
        datestr = YYYY " " MM " " DD

        # create timestamp (needs "YYYY MM DD HH MM SS" format)
        datetime = mktime(datestr " " timestr)

        # extract month abbreviation ("Jan", "Feb", etc.)
        monthstr = strftime("%b", datetime)

        # map month abbreviation to month string ("MM" format)
        monthstr2MM[monthstr] = MM
    }
}

# read timestamp from log input
{
    # convert month abbreviation in 1st field to string ("MM" format)
    MM = monthstr2MM[$1]

    # extract date from 2nd field (already in "DD" format)
    DD = $2

    # assemble date string ("YYYY MM DD" format)
    # Note: YYYY still is the current year for all timestamps. So this
    # will fail if the log spans the change from one year to the next.
    datestr = YYYY " " MM " " DD

    # extract time string from 2nd field ("HH:MM:SS" format)
    timestr=$3

    # convert time string to "HH MM SS" format
    gsub(":"," ",timestr)

    # create timestamp from "YYYY MM DD HH MM SS" format
    datetime = mktime(datestr " " timestr)
}

# if current timestamp differs from previous: print time difference
(NR != 1) && (datetime != previous) {

    # calculate time difference (in seconds)
    timediff = datetime - previous

    # print minutes and seconds passed since previous timestamp
    printf "%im %is\n",int(timediff/60),timediff%60
}

# store current timestamp for comparison with the next one
{
    previous = datetime
}

如果现在我将其保存为timediff.awk，您的示例输入为log.file并运行

awk -f timediff.awk < log.file

我得到了

13m 15s

这正是

之间的区别

May 27 02:43:40

和

May 27 02:56:55

如果您需要进一步的解释/调整，请与我们联系。

在不同的输出线上进行操作

1 个答案: