如何使用 grep 进行应用程序事件日志搜索？

Question

我想使用 Grep 在 Windows 应用程序事件日志中搜索字符串。 以下是日志摘录：

I  05-Nov-14 10:08:04   51033   AP_AN           <I>1 images out of 1 are     transferred to ABS_Dynamics for the job(297.0.0) at the rate of 0.09 images / sec.    </I>
                                                                    Time: 5.11.2014, 10:08:04, Line: 1068, File: \EdCom\src\ArcNet\ArcNet_server\src\ANBeServer/ANBeNetworkNodeJob_haz.cpp, Process: CGenericMain (7804)
W  05-Nov-14 10:08:53   14  AXY_ISC           State Manager has detected a hung process.    
                                                                    Time: 5.11.2014, 10:08:53, Process: C:\AIOM\Service\bin\Rep.exe_1976,
                                                                    Text: (05.11.2014 10:08:53) IV SET: CProcess::DeclareHung(AppUI_A,6228) Process appears to be hung. (null
W  05-Nov-14 10:08:53   17  AXY_ISC           An error was detected in a process that is monitored by State Manager.    
                                                                    Time: 5.11.2014, 10:08:53, Process: C:\AIOM\Service\bin\Rep.exe_1976,
                                                                    Text: (05.11.2014 10:08:53) IVS SET: CMonitorThread::ProcessFailing(PID:6228 TID:4264) Process AppUI_A is 

我想在事件日志中搜索一个字符串“CProcess::DeclareHung”，搜索输出应该如下：

W  05-Nov-14 10:08:53   14  AXY_ISC           State Manager has detected a hung process.    
                                                                    Time: 5.11.2014, 10:08:53, Process: C:\AIOM\Service\bin\Rep.exe_1976,
                                                                    Text: (05.11.2014 10:08:53) IV SET: CProcess::DeclareHung(AppUI_A,6228) Process appears to be hung. (null

即。包括搜索字符串的日志和摘要行。

每行由换行符分隔，此日志文件为 .txt 文件。 我知道 grep 是一个基于行的搜索应用程序，但是，我读过使用珍珠正则表达式，我们可以使 grep 搜索多行。我是珍珠正则表达式的新手，完全不知道如何做到这一点。

谁能帮我用 grep 搜索这个？

编辑：我尝试了以下方法，但没有成功

grep -P "[W|E|I]  \d\d-\w\w\w-\d\d.*[\s]*.*CProcess::DeclareHung.*[\s]*.*" XA2014_11_04_AppEventLog.txt

Answer 1

假设你想检查什么不在标题中，但在错误信息中，你可以说：

awk -v RS="\n(E|I|W)" '/CProcess/' file

这里的遗憾是你丢失了 E/I/W。如果需要，请说awk -v RS="\n(E|I|W)" '/CProcess/ {print RT, $0}' file。

更基本的方法是在块中保留一个缓冲区，并在找到匹配项时打印它：

awk '$1~/^(E|I|W)$/ {line=$0;next} {line=line ORS $0} /pattern/ {print line}' file

即：

awk '$1~/^(E|I|W)$/ {line=$0;next} # if 1st file starts with E,I,W, initialize the
                                # variable line with the content of this line
                                # then, jump to the next line

    {line=line ORS $0}          # on the rest of cases, keep adding the following
                                # lines in the variable line
                                # ORS stands for new line normally

    /pattern/ {print line}'     # if the current line matches the given pattern
                                # print the stored variable `line`
    file

无论在文本中的何处找到匹配，打印匹配的类似逻辑：

awk '{if ($1~/^(E|I|W)$/)
      {
        if (print_match) {
            print line
            print_match=0
        }
        line=$0
      } else 
        line=line ORS $0
     }
    /An error/ {print_match=1}
    END {if (print_match) print line}' file

注意使用标志print_match 来了解是否需要打印缓冲行。如果它是文件的最后一个块，也可以使用END 来打印它。

---

使用“CProcess”对您给定的样本进行测试：

awk -v RS="\n(E|I|W)" '/CProcess/' file
  05-Nov-14 10:08:53   14  AXY_ISC           State Manager has detected a hung process.    
                                                                    Time: 5.11.2014, 10:08:53, Process: C:\AIOM\Service\bin\Rep.exe_1976,
                                                                    Text: (05.11.2014 10:08:53) IV SET: CProcess::DeclareHung(AppUI_A,6228) Process appears to be hung. (null

和

$ awk '$1~/^(E|I|W)$/ {line=$0;next} {line=line ORS $0} /CProcess/ {print line}' file
W  05-Nov-14 10:08:53   14  AXY_ISC           State Manager has detected a hung process.    
                                                                    Time: 5.11.2014, 10:08:53, Process: C:\AIOM\Service\bin\Rep.exe_1976,
                                                                    Text: (05.11.2014 10:08:53) IV SET: CProcess::DeclareHung(AppUI_A,6228) Process appears to be hung. (null