再次冒砖泪求日志文本处理

moshangxie

日志文本如下：

1. Sun Jan 31 00:00:01 2010
   
2.         User-Name = "test0023"
   
3.         NAS-Port = 17827544
   
4.         NAS-IP-Address = 10.60.255.1
   
5.         Framed-IP-Address = 10.72.3.127
   
6.         NAS-Identifier = "TEST"
   
7.         Acct-Status-Type = Stop
   
8.         Acct-Delay-Time = 0
   
9.         Acct-Input-Octets = 320782848
   
10.         Acct-Output-Octets = 1110648668
    
11.         Acct-Session-Id = "TEST01100000001752ed887723033"
    
12.         Acct-Authentic = RADIUS
    
13.         Acct-Session-Time = 26110
    
14.         Acct-Input-Packets = 1190968
    
15.         Acct-Output-Packets = 1213428
    
16.         Acct-Terminate-Cause = User-Request
    
17.         Acct-Input-Gigawords = 0
    
18.         Acct-Output-Gigawords = 0
    
19.         Event-Timestamp = "Jan 31 2010 07:45:43 EAT"
    
20.         NAS-Port-Type = Ethernet
    
21.         Calling-Station-Id = "00:02:3f:07:48:11"
    
22.         NAS-Port-Id = "slot=1;subslot=1;port=0;vlanid=1752;"
    
23.         Acct-Tunnel-Packets-Lost = 0
    
24.         Service-Type = Framed-User
    
25.         Framed-Protocol = PPP
    
26.         SK-Attr-60 = 0x31302e37322e332e3132372030303a30323a33663a30373a34383a3131
    
27.         SK_Input_Peak_Rate = 1048576
    
28.         SK_Input_Average_Rate = 1048576
    
29.         SK_Out_Peak_Rate = 10485760
    
30.         SK_Out_Average_Rate = 10485760
    
31.         SK-Attr-22 = 0x00000000
    
32.         SK-Attr-26 = 0x000059f9
    
33.         SK-Attr-138 = 0x71696e6764616f6d656469612e636f6d
    
34.         Client-IP-Address = 10.60.255.1
    
35.         Acct-Unique-Session-Id = "3b3c5639bdf52982"
    
36.         Timestamp = 1264867201
    
37. 
    
38. Sun Jan 31 00:00:02 2010
    
39.         User-Name = "test0013"
    
40.         NAS-Port = 17827764
    
41.         NAS-IP-Address = 10.60.255.1
    
42.         Framed-IP-Address = 10.72.1.131
    
43.         NAS-Identifier = "TEST"
    
44.         Acct-Status-Type = Start
    
45.         Acct-Delay-Time = 0
    
46.         Acct-Session-Id = "TEST011000000019720ed8f624654"
    
47.         Acct-Authentic = RADIUS
    
48.         Event-Timestamp = "Jan 31 2010 07:45:44 EAT"
    
49.         NAS-Port-Type = Ethernet
    
50.         Calling-Station-Id = "00:10:5c:e8:77:a4"
    
51.         NAS-Port-Id = "slot=1;subslot=1;port=0;vlanid=1972;"
    
52.         Acct-Tunnel-Packets-Lost = 0
    
53.         Service-Type = Framed-User
    
54.         Framed-Protocol = PPP
    
55.         SK-Attr-60 = 0x31302e37322e312e3133312030303a31303a35633a65383a37373a6134
    
56.         SK_Input_Peak_Rate = 1048576
    
57.         SK_Input_Average_Rate = 1048576
    
58.         SK_Out_Peak_Rate = 10485760
    
59.         SK_Out_Average_Rate = 10485760
    
60.         SK-Attr-22 = 0x00000000
    
61.         SK-Attr-26 = 0x0000604e
    
62.         SK-Attr-138 = 0x71696e6764616f6d656469612e636f6d
    
63.         Client-IP-Address = 10.60.255.1
    
64.         Acct-Unique-Session-Id = "2c32637ece099079"
    
65.         Timestamp = 1264867202

复制代码

要获取User-Name，Framed-IP-Address，NAS-Identifier，Acct-Status-Type，Acct-Session-Time，
Calling-Station-Id，Acct-Unique-Session-Id，（Timestamp-Acct-Session-Time），Timestamp的值，如果行中没有Acct-Session-Tim则将该值补为0，即得到如下结果：

1. test0023  10.72.3.127  TEST  Stop  26110   00:02:3f:07:48:11   3b3c5639bdf52982  2010-01-30 16:44:51 2010-01-31 00:00:01
   
2. test0013  10.72.1.131  TEST  Start   0          00:10:5c:e8:77:a4   2c32637ece099079 2010-01-31 00:00:02  2010-01-31 00:00:02

复制代码

请问如何实现？谢谢！！！

expert1

设RS为Sun Jan 31 00:00:02 2010

expert1

回复 1# moshangxie


    http://blog.chinaunix.net/space. ... o=blog&id=34034
和这个类似，FYI

cjaizss

花点时间学下awk很有必要

ywlscpl

回复 1# moshangxie

1. awk 'BEGIN{a[1]="User-Name";a[2]="Framed-IP-Address";a[3]="NAS-Identifier";a[4]="Acct-Status-Type";a[5]="Acct-Session-Time";a[6]="Calling-Station-Id";a[7]="Acct-Unique-Session-Id";a[8]="Acct-Session-Time";a[9]="Timestamp"}{for (i=1;i<=9;i++) if ($1==a[i]) {gsub(/"/,"",$NF);b[i]=$NF}}$1=="Timestamp"{for (i=1;i<=9;i++) {if (i==5&&!b[i]) b[i]=0;if (i==8) if (!b[i]) b[i]=b[9];else b[i]=b[9]-b[i];if (i==8||i==9) b[i]=strftime("%Y-%m-%d %H:%M:%S",b[i]);printf b[i]"\t"}print "";delete b}' file

复制代码

1. ywlscpl@ubuntu:~$ awk 'BEGIN{a[1]="User-Name";a[2]="Framed-IP-Address";a[3]="NAS-Identifier";a[4]="Acct-Status-Type";a[5]="Acct-Session-Time";a[6]="Calling-Station-Id";a[7]="Acct-Unique-Session-Id";a[8]="Acct-Session-Time";a[9]="Timestamp"}{for (i=1;i<=9;i++) if ($1==a[i]) {gsub(/"/,"",$NF);b[i]=$NF}}$1=="Timestamp"{for (i=1;i<=9;i++) {if (i==5&&!b[i]) b[i]=0;if (i==8) if (!b[i]) b[i]=b[9];else b[i]=b[9]-b[i];if (i==8||i==9) b[i]=strftime("%Y-%m-%d %H:%M:%S",b[i]);printf b[i]"\t"}print "";delete b}' file
   
2. test0023        10.72.3.127     TEST    Stop    26110   00:02:3f:07:48:11      3b3c5639bdf52982 2010-01-30 16:44:51     2010-01-31 00:00:01
   
3. test0013        10.72.1.131     TEST    Start   0       00:10:5c:e8:77:a4      2c32637ece099079 2010-01-31 00:00:02     2010-01-31 00:00:02
   
4. ywlscpl@ubuntu:~$ awk --version
   
5. GNU Awk 3.1.6
   
6. Copyright (C) 1989, 1991-2007 Free Software Foundation.

复制代码

rdcwayx

http://bbs.chinaunix.net/viewthr ... 8&rpid=21447759

为何要重复发贴?

moshangxie

回复 6# rdcwayx


    需求不一样，见谅。

springwind426

1. 
   
2. perl -ne '
   
3. chomp;
   
4. s/^\s*//;
   
5. if(/^User/){$a{"Acct-Session-Time"}=0;}
   
6. if(/(.*?)\s*=\s*("?)(.+)\2/){$a{$1}=$3;}
   
7. if(/^TimeStamp/i){printf "%-10s\t%-10s\t%-10s\t%-10s\t%-10s\t%-10s\t%-10s\n"
   
8. ,$a{"User-Name"}
   
9. ,$a{"Framed-IP-Address"}
   
10. ,$a{"NAS-Identifier"}
    
11. ,$a{"Acct-Status-Type"}
    
12. ,$a{"Acct-Session-Time"}
    
13. ,$a{"Calling-Station-Id"}
    
14. ,$a{"Acct-Unique-Session-Id"}
    
15. }' data1
    
16. 
    

复制代码