打印所有变量值大于某个数字的行[关闭]

Question

需要有关 unix 命令的帮助：

我想从日志文件中列出/grep 所有具有“abdc7dac-abdf-4088-ba87-ca5ee765f3eb”且 etime 大于 5 的行：

来自日志的片段：

access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242995 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=6
access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242987 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=7
access:[29/Dec/2018:14:59:38 +0000] EXTENDED RES conn=74243079 op=0 msgID=1 name="StartTLS" oid="1.3.6.1.4.1.1466.20037" result=0 etime=0
access:[29/Dec/2018:14:59:38 +0000] SEARCH RES conn=74242947 op=2 msgID=3 result=0 nentries=0 etime=1
access:[29/Dec/2018:14:59:38 +0000] SEARCH RES conn=74242945 op=2 msgID=3 result=0 nentries=0 etime=0
access:[29/Dec/2018:14:59:38 +0000] EXTENDED RES conn=74243083 op=0 msgID=1 name="StartTLS" oid="1.3.6.1.4.1.1466.20037" result=0 etime=1
access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242989 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=2

期望的输出：

access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242995 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=6
access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242987 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=7

Answer 1

grep abdc7dac-abdf-4088-ba87-ca5ee765f3eb logfile |awk -F "etime=" '$2>5{print}' > modifiedlog.txt

样本输出：

auxilus@ubuntu:~$ cat logfile 
access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242995 op=1 
msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=6
access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242987 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=7
access:[29/Dec/2018:14:59:38 +0000] EXTENDED RES conn=74243079 op=0 msgID=1 name="StartTLS" oid="1.3.6.1.4.1.1466.20037" result=0 etime=0
access:[29/Dec/2018:14:59:38 +0000] SEARCH RES conn=74242947 op=2 msgID=3 result=0 nentries=0 etime=1
access:[29/Dec/2018:14:59:38 +0000] SEARCH RES conn=74242945 op=2 msgID=3 result=0 nentries=0 etime=0
access:[29/Dec/2018:14:59:38 +0000] EXTENDED RES conn=74243083 op=0 msgID=1 name="StartTLS" oid="1.3.6.1.4.1.1466.20037" result=0 etime=1
access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242989 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=2

auxilus@ubuntu:~$ grep abdc7dac-abdf-4088-ba87-ca5ee765f3eb logfile |awk -F "etime=" '$2>5{print}'
access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242995 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=6
access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242987 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=7
auxilus@ubuntu:~$

更好的版本：

awk -F "etime=" '/abdc7dac-abdf-4088-ba87-ca5ee765f3eb/ {if ($2>5) {print}}' logfile

Answer 2

您不希望行以 etime= 和 0 到 5 之间的数字结尾。
在其他行中，您只想查看带有abdc7dac-abdf-4088-ba87-ca5ee765f3eb 的行。综合：

sed -n '/etime=[0-5]$/d;/abdc7dac-abdf-4088-ba87-ca5ee765f3eb/p' logfile

Answer 3

使用基本正则表达式的简单grep 解决方案将处理具有值6-9 的单个etime= 或任何多位etime=（例如etime=[6-9] 或etime=[0-9][0-9][0-9]*）：

$ grep 'abdc7dac-abdf-4088-ba87-ca5ee765f3eb.*etime=\([6-9]\|[0-9][0-9][0-9]*\).*$' file

使用您的 file 作为输入会产生以下结果：

$ grep 'abdc7dac-abdf-4088-ba87-ca5ee765f3eb.*etime=\([6-9]\|[0-9][0-9][0-9]*\).*$' file
access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242995 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=6
access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242987 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=7

如果您的文件还包含两位（或更多）数字 etime，也会被捕获，例如

access:[29/Dec/2018:14:59:38 +0000] BIND RES conn=74242989 op=1 msgID=2 result=0 authDN="ldapguid=abdc7dac-abdf-4088-ba87-ca5ee765f3eb,dc=abc,dc=com" etime=12

您可以调整数字范围以根据您的需要进行匹配。