代码之家 › 专栏 › 技术社区 › Ivan Denchev

Apache-过去一小时的日志

cpanel awk logging apache linux

-1

Ivan Denchev · 技术社区 · 8 年前

我正在使用 cPanel帐户 还有一个 Apache 2.4访问日志 将其日志存储为:

66.249.93.30 - - [04/May/2018:21:26:39 +0200] "GET / HTTP/1.1" 302 207 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; Google Page Speed Insights) Chrome/41.0.2272.118 Safari/537.36"
66.249.93.30 - - [05/May/2018:10:26:39 +0200] "GET / HTTP/1.1" 302 207 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; Google Page Speed Insights) Chrome/41.0.2272.118 Safari/537.36"

日期格式为日期“+%d/%B/%Y:%k:%M:%S”

使用bash脚本,我只想提取 最近一小时登录 ,例如:

完整日志文件:

66.249.93.30 - - [04/May/2018:21:26:39 +0200] First Line
66.249.93.30 - - [05/May/2018:11:00:21 +0200] Second Line
66.249.93.30 - - [05/May/2018:11:15:39 +0200] Third Line
66.249.93.30 - - [05/May/2018:12:00:11 +0200] Fourth Line

当前时间: 2018年5月5日: 12: 01年 :06

日志来自: 5月5日 11: 01-12:01

过滤输出:

66.249.93.30 - - [05/May/2018:11:15:39 +0200] Third Line
66.249.93.30 - - [05/May/2018:12:00:11 +0200] Fourth Line

我已经尝试使用awk和其他一些建议,但我无法让它工作,任何帮助将不胜感激!

2 回复 | 直到 8 年前

Ed Morton 8 年前

$ date
Sat, May 05, 2018 10:49:13 AM

$ cat tst.awk
{
    split($4,t,/[[ :\/]/)
    mthNr = sprintf("%02d",(index("JanFebMarAprMayJunJulAugSepOctNovDec",t[3])+2)/3)
    curTime = t[4] mthNr t[2] t[5] t[6] t[7]
}
curTime >= minTime

$ awk -v minTime=$(date -d '60 min ago' '+%Y%m%d%H%M%S') -f tst.awk file
66.249.93.30 - - [05/May/2018:11:00:21 +0200] Second Line
66.249.93.30 - - [05/May/2018:11:15:39 +0200] Third Line
66.249.93.30 - - [05/May/2018:12:00:11 +0200] Fourth Line

利用问题的时间获得问题的预期输出:

$ awk -v minTime=$(date -d '2018/05/05 11:01:06' '+%Y%m%d%H%M%S') -f tst.awk file
66.249.93.30 - - [05/May/2018:11:15:39 +0200] Third Line
66.249.93.30 - - [05/May/2018:12:00:11 +0200] Fourth Line

-1

Ivan Denchev 8 年前

我能弄明白!

我必须转换 2018年5月4日:21:26:39 到UNIX时间戳。这是通过以下方法实现的日期

date -d "YEAR-MONTH-DAY HR:M:S" "+%S"

然后再做一个 延迟60分钟的UNIX时间戳

date -d "60 min ago" "+%s"

在if条件筛选器中 UNIX时间戳大于时间戳后60分钟(-gt)的所有日志项

使用当前设置:

cPanel+Apache 2.4

日志记录格式: /主页/$用户/公共\u html\u cron\u日志/$天/$小时-$分钟-[获取|帖子]。日志

Like/home/$USER/public\u html\u cron\u logs/05-05-2018/14-53-GET。日志

#!/bin/bash

LOG_DIR="public_html_cron_logs"

DAY=`date +"%d-%m-%Y"`
HOUR=`date "+%H-%M"`
GET_LOG="GET.log"
POST_LOG="POST.log"

if [ ! -d /home/$USER/$LOG_DIR/$DAY ]; then
    mkdir /home/$USER/$LOG_DIR/$DAY;
fi

CREATE_DIR=/home/$USER/$LOG_DIR/$DAY
GET_LOG=$CREATE_DIR/$HOUR-$GET_LOG
POST_LOG=$CREATE_DIR/$HOUR-$POST_LOG

while read line; do

    DATE_LOG=`echo $line | awk '{print $4}'`; DATE_LOG=${DATE_LOG:1}
    MONTH_VERB=`echo $DATE_LOG | awk -F '[/:]' '{print $2}'`

    if [ "$MONTH_VERB" = "January" ]; then
        MONTH=01
    elif [ "$MONTH_VERB" = "February" ]; then
        MONTH=02
    elif [ "$MONTH_VERB" = "March" ]; then
        MONTH=03
    elif [ "$MONTH_VERB" = "April" ]; then
        MONTH=04
    elif [ "$MONTH_VERB" = "May" ]; then
        MONTH=05
    elif [ "$MONTH_VERB" = "June" ]; then
        MONTH=06
    elif [ "$MONTH_VERB" = "July" ]; then
        MONTH=07
    elif [ "$MONTH_VERB" = "August" ]; then
        MONTH=08
    elif [ "$MONTH_VERB" = "September" ]; then
        MONTH=09
    elif [ "$MONTH_VERB" = "October" ]; then
        MONTH=10
    elif [ "$MONTH_VERB" = "November" ]; then
        MONTH=11
    elif [ "$MONTH_VERB" = "December" ]; then
        MONTH=12
    fi

    UNIX_DATE=`echo $DATE_LOG | awk -v AWK_MONTH="$MONTH" -F '[/:]' '{print $3"-"AWK_MONTH"-"$1" "$4":"$5":"$6}'`
    UNIX_TIMESTAMP_LOG=`date -d "$UNIX_DATE" "+%s"`
    UNIX_TIMESTAMP_LAST_HOUR=`date -d '60 min ago' "+%s"`

    if  [ $UNIX_TIMESTAMP_LOG -gt $UNIX_TIMESTAMP_LAST_HOUR ]; then
        if [[ $line = *"GET"* ]]; then
            echo $line | awk '{print $1}' >> $GET_LOG
        else
            echo $line | awk '{print $1}' >> $POST_LOG
        fi
    fi

done < ~/access-logs/ENTER_YOUR_DOMAIN_LOG_FILE_HERE