在不同的输出线上进行操作

Question

我编写了一些脚本来安排文件的输出并打印第一个字段，时间是这样的：15:23:30。

我尝试通过将第一个字段的每个部分相乘以将其转换为秒来转换第一个字段，然后在每两行之间进行减法，但我不能将每一行都作为参数来在每两行之间进行运算.

for rec in $(cut -d " " -f2 file.txt | uniq -d); do
   grep -- "$rec" file.txt done |
awk '{split($0,a," "); print a[1] }'

输入文件类似于 /var/log/messages

May 27 02:43:40 Rolly NetworkManager[2411]: <info> (eth0): DHCPv4 state changed renew -> renew
May 27 02:43:40 Rolly NetworkManager[2411]: <info>   address 192.168.159.133
May 27 02:43:40 Rolly NetworkManager[2411]: <info>   prefix 24 (255.255.255.0)
May 27 02:43:40 Rolly NetworkManager[2411]: <info>   gateway 192.168.159.2
May 27 02:43:40 Rolly NetworkManager[2411]: <info>   nameserver '192.168.159.2'
May 27 02:43:40 Rolly NetworkManager[2411]: <info>   domain name 'localdomain'
May 27 02:56:55 Rolly dhclient[2481]: DHCPREQUEST on eth0 to 192.168.159.254 port 67 (xid=0x3bb3abec)
May 27 02:56:55 Rolly dhclient[2481]: DHCPACK from 192.168.159.254 (xid=0x3bb3abec)
May 27 02:56:55 Rolly dhclient[2481]: bound to 192.168.159.133 -- renewal in 795 seconds.
May 27 02:56:55 Rolly NetworkManager[2411]: <info> (eth0): DHCPv4 state changed renew -> renew

所需的输出应该是时间列 然后对它的某些行进行一些操作

我想得到类似的输出

1m 25s

如果我可以通过减去转换时间的 2 个值来获得某些过程的持续时间

Answer 1

我写了以下awk 脚本：

# initiate mapping array "Jan"->"01", "Feb"->"02", etc.
BEGIN {
    # assume all dates are from the current year
    YYYY = strftime("%Y", systime())

    # use first day of the month to extract month abbreviations
    # Note: Any day from "01" to "28" would work here.
    DD = "01"

    # use midnight as time for month abbreviation extraction
    # Note: Any (valid) time would work here.
    HH = "00"
    MM = HH
    SS = MM

    # assemble time string ("MM HH SS" format)
    timestr = MM " " HH " " SS

    # iterate over all months
    for (month = 1; month <= 12; ++month) {

        # convert month number to two-digit string ("MM" format)
        MM = sprintf("%02i", month)

        # assemble date string ("YYYY MM DD" format)
        datestr = YYYY " " MM " " DD

        # create timestamp (needs "YYYY MM DD HH MM SS" format)
        datetime = mktime(datestr " " timestr)

        # extract month abbreviation ("Jan", "Feb", etc.)
        monthstr = strftime("%b", datetime)

        # map month abbreviation to month string ("MM" format)
        monthstr2MM[monthstr] = MM
    }
}

# read timestamp from log input
{
    # convert month abbreviation in 1st field to string ("MM" format)
    MM = monthstr2MM[$1]

    # extract date from 2nd field (already in "DD" format)
    DD = $2

    # assemble date string ("YYYY MM DD" format)
    # Note: YYYY still is the current year for all timestamps. So this
    # will fail if the log spans the change from one year to the next.
    datestr = YYYY " " MM " " DD

    # extract time string from 2nd field ("HH:MM:SS" format)
    timestr=$3

    # convert time string to "HH MM SS" format
    gsub(":"," ",timestr)

    # create timestamp from "YYYY MM DD HH MM SS" format
    datetime = mktime(datestr " " timestr)
}

# if current timestamp differs from previous: print time difference
(NR != 1) && (datetime != previous) {

    # calculate time difference (in seconds)
    timediff = datetime - previous

    # print minutes and seconds passed since previous timestamp
    printf "%im %is\n",int(timediff/60),timediff%60
}

# store current timestamp for comparison with the next one
{
    previous = datetime
}

如果现在我将其保存为 timediff.awk 并将您的示例输入保存为 log.file 并运行

awk -f timediff.awk < log.file

我明白了

13m 15s

这正是两者的区别

5 月 27 日 02:43:40

和

5 月 27 日 02:56:55

如果您需要进一步的解释/调整，请告诉我。