查找内日志文件条目[时间跨度]（如最后一小时） [英] Find entries in log file within [timespan] (eg. the last hour)

问题描述

我的服务器具有高用unsual CPU使用率，我可以看到Apache是​​使用了太多的内存。
我有一种感觉，我被DOS'd由一个单一的IP？ - 也许你可以帮我找到他

我用下面的行，寻找10个最活跃的IP地址：

 猫access.log里| AWK'{打印$ 1}'|排序| uniq的-c |排序-n |尾
 

前5位的IP约200倍的对服务器的请求，作为平均的用户。但是，我找不到了，如果这些都5只是很经常访港的旅客，或者他们正在攻击的服务器。

时有方式，来指定上述搜索到的时间间隔，例如。最后两小时，或10-12之间今天？

干杯！

已更新2011年10月23日 - 我所需要的命令：

获取最近X小时内的条目[这里有两个小时]

  AWK -vDate =`日期-d'now 2小时+ [％D /％B /％Y：％H：％M：％S`'{如果（ $ 4是H.日）打印日期FS $ 4}'的access.log
 

获取最近X小时内最活跃的IP [这里有两个小时]

  AWK -vDate =`日期-d'now 2小时+ [％D /％B /％Y：％H：％M：％S`'{如果（ $ 4是H.日）打印$ 1}'的access.log |排序| uniq的-c |排序-n |尾巴
 

获取条目相对时间跨度内

  AWK -vDate =`日期-d'now-4小时+ [％D /％B /％Y：％H：％M：％S` -vDate2 =`日期-d'now 2小时+ [％D /％b /％Y：％H：％M：％S`'{如果（$ 4是H.日期和放大器;＆放大器; $ 4℃;日期2）印刷日期FS日期2 FS $ 4}'的access.log
 

获取条目中的绝对时间跨度

  AWK -vDate =`日期-d '13：20'+％D /％B /％Y：％H：％M：％S` -vDate2 =`日期-d'13：30'+％D /％b /％Y：％H：％M：％S`'{如果（$ 4是H.日期和放大器;＆放大器; $ 4℃;日期2）打印$ 0}的访问。日志
 

得到绝对的时间跨度内最活跃的IP

  AWK -vDate =`日期-d '13：20'+％D /％B /％Y：％H：％M：％S` -vDate2 =`日期-d'13：30'+％D /％b /％Y：％H：％M：％S`'{如果（$ 4是H.日期和放大器;＆放大器; $ 4℃;日期2）打印$ 1}的访问。登录|排序| uniq的-c |排序-n |尾巴
 

解决方案

是的，有多种方法可以做到这一点。这里是我会去这一点。对于初学者来说，没必要管猫的输出，只需打开与 AWK 日志文件。

  AWK -vDate =`日期-d'now 2小时+ [％D /％B /％Y：％H：％M：％S`'$ 4为H.日期{打印日期，$ 0}访问日志
 

假设你的日志看起来像我（他们配置）比日期存储在字段4，并加括号。什么我做以上是在过去2小时内发现的一切。 注意-d'now 2小时或从字面上翻译，现在减去2小时，这对我来说看起来是这样的： [10 /月/ 2011 ：08：55：23

那么，我做的是以前存储的两个小时格式的价值和对字段four进行比较。有条件前pression要直forward.I正在然后打印的日期，接着输出字段分隔符 - 随后整个线$ 0（OFS或空间在这种情况下）。你可以使用你的previous前pression，只是打印$ 1（IP地址）

  AWK -vDate =`日期-d'now 2小时+ [％D /％B /％Y：％H：％M：％S`'$ 4为H.日期{打印$ 1}'|排序| uniq的-c |排序-n |尾巴
 

如果你想使用的范围指定两个日期变量，并适当建设你的前pression。

所以，如果你想真的发现2-4hrs之间的事情以前你的前pression威力看起来像这样

  AWK -vDate =`日期-d'now-4小时+ [％D /％B /％Y：％H：％M：％S` -vDate2 =`日期-d'now 2小时+ [％D /％b /％Y：％H：％M：％S`'$ 4为H.日期和放大器;＆安培; $ 4℃; DATE2 {打印日期，日期2，$ 4}访问日志
 

下面是我回答了有关在bash日期您有帮助的问题。
<一href=\"http://stackoverflow.com/questions/6497525/print-date-for-the-monday-of-the-current-week-in-bash/6497622#6497622\">Print日期为当前周的星期一（在bash）

My server is having unsual high CPU usage, and I can see Apache is using way too much memory. I have a feeling, I'm being DOS'd by a single IP - maybe you can help me find him?

I've used the following line, to find the 10 most "active" IPs:

cat access.log | awk '{print $1}' |sort  |uniq -c |sort -n |tail

The top 5 IPs have about 200 times as many requests to the server, as the "average" user. However, I can't find out if these 5 are just very frequent visitors, or they are attacking the servers.

Is there are way, to specify the above search to a time interval, eg. the last two hours OR between 10-12 today?

Cheers!

UPDATED 23 OCT 2011 - The commands I needed:

Get entries within last X hours [Here two hours]

awk -vDate=`date -d'now-2 hours' +[%d/%b/%Y:%H:%M:%S` ' { if ($4 > Date) print Date FS $4}' access.log

Get most active IPs within the last X hours [Here two hours]

awk -vDate=`date -d'now-2 hours' +[%d/%b/%Y:%H:%M:%S` ' { if ($4 > Date) print $1}' access.log | sort  |uniq -c |sort -n | tail

Get entries within relative timespan

awk -vDate=`date -d'now-4 hours' +[%d/%b/%Y:%H:%M:%S` -vDate2=`date -d'now-2 hours' +[%d/%b/%Y:%H:%M:%S` ' { if ($4 > Date && $4 < Date2) print Date FS Date2 FS $4}' access.log

Get entries within absolute timespan

awk -vDate=`date -d '13:20' +[%d/%b/%Y:%H:%M:%S` -vDate2=`date -d'13:30' +[%d/%b/%Y:%H:%M:%S` ' { if ($4 > Date && $4 < Date2) print $0}' access.log 

Get most active IPs within absolute timespan

awk -vDate=`date -d '13:20' +[%d/%b/%Y:%H:%M:%S` -vDate2=`date -d'13:30' +[%d/%b/%Y:%H:%M:%S` ' { if ($4 > Date && $4 < Date2) print $1}' access.log | sort  |uniq -c |sort -n | tail

解决方案

yes, there are multiple ways to do this. Here is how I would go about this. For starters, no need to pipe the output of cat, just open the log file with awk.

awk -vDate=`date -d'now-2 hours' +[%d/%b/%Y:%H:%M:%S` '$4 > Date {print Date, $0}' access_log

assuming your log looks like mine (they're configurable) than the date is stored in field 4. and is bracketed. What I am doing above is finding everything within the last 2 hours. Note the -d'now-2 hours' or translated literally now minus 2 hours which for me looks something like this: [10/Oct/2011:08:55:23

So what I am doing is storing the formatted value of two hours ago and comparing against field four. The conditional expression should be straight forward.I am then printing the Date, followed by the Output Field Separator (OFS -- or space in this case) followed by the whole line $0. You could use your previous expression and just print $1 (the ip addresses)

awk -vDate=`date -d'now-2 hours' +[%d/%b/%Y:%H:%M:%S` '$4 > Date {print $1}' | sort  |uniq -c |sort -n | tail

If you wanted to use a range specify two date variables and construct your expression appropriately.

so if you wanted do find something between 2-4hrs ago your expression might looks something like this

awk -vDate=`date -d'now-4 hours' +[%d/%b/%Y:%H:%M:%S` -vDate2=`date -d'now-2 hours' +[%d/%b/%Y:%H:%M:%S` '$4 > Date && $4 < Date2 {print Date, Date2, $4} access_log'

Here is a question I answered regarding dates in bash you might find helpful. Print date for the monday of the current week (in bash)

这篇关于查找内日志文件条目[时间跨度]（如最后一小时）的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！