- 论坛徽章:
- 0
|
本帖最后由 linusex007 于 2012-02-19 13:59 编辑
请教坛里各位一问题:
我想将squid的日志用awk调整成类似apache格式的日志,squid的日志格式如下,无法修改,只能靠工具改写格式.
[root@vm 120212]# head -1 /data1/squid/var/logs/squid_access.log
haha.sina.com.cn 121.18.126.126 131 TCP_MISS:DIRECT [19/Feb/2012:11:58:01 +0800] "GET http://haha.com.cn/gossip/ HTTP/1.1" 200 37574 "http://haha.com.cn/gossip/slide_2_730_23569.html" - "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)" - -
改写成如下格式:
[root@vm 120212]# cat 120212.haha.com.cn.gz |head -1
221.198.97.42 - - [11/Feb/2012:23:58:04 +0800] 4 "GET /test/Smc.radio.mix_100630.js HTTP/1.1" 200 6985 "http://vipmail.com.cn/classic/index.php?fl" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" TCP_MEM_HIT:NONE
用awk已经调整正确,但实在没想出如何打印$2 $4 $6字段两边的“******”
[root@vm 120212]# awk -F "\"" '{split($1,a," ");print a[2],$NF,a[5],a[6],a[3],$2,$3,$4,$6,a[4]}' squid_access.log |head -1
121.18.126.126 - - [19/Feb/2012:11:58:01 +0800] 131 GET http://haha.com.cn/gossip/ HTTP/1.1 200 37574 http://haha.com.cn/gossip/slide_2_730_23569.html Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) TCP_MISS:DIRECT
哪位大侠帮忙看看,感激啊! |
|