awk脚本 求助 谢谢

kwingart

我有很多类似这样的nagios记录，时间是从0点0分0秒 到 23:59:59
关键字是  DOWN WARNING CRITICAL，有这些字样的记录就会发出告警短信。

[Sun Apr 13 12:47:09 2014] HOST ALERT: check_North;DOWN;SOFT;1;(Host check timed out after 30.00 seconds)
[Sun Apr 13 12:47:10 2014] HOST ALERT: 242.103;DOWN;HARD;2;(Host check timed out after 30.00 seconds)
[Sun Apr 13 12:47:10 2014] HOST NOTIFICATION: xiaofei;242.103;DOWN;notify-host-by-email;(Host check timed out after 30.00 seconds)
[Sun Apr 13 12:47:13 2014] HOST ALERT: dx-144.23;DOWN;SOFT;1;(Host check timed out after 30.00 seconds)
[Sun Apr 13 12:47:13 2014] HOST ALERT: 242.109;DOWN;SOFT;1;(Host check timed out after 30.00 seconds)
[Sun Apr 13 12:47:16 2014] HOST ALERT: IIS242.209;DOWN;SOFT;1;(Host check timed out after 30.00 seconds)
[Sun Apr 13 12:47:17 2014] HOST ALERT: 242.220;DOWN;SOFT;1;(Host check timed out after 30.00 seconds)
[Sun Apr 13 15:15:41 2014] SERVICE ALERT: dx-144.8;checkPro-hqc;WARNING;SOFT;1;No data was received from host!
[Sun Apr 13 18:57:48 2014] SERVICE ALERT: IIS242.240;checkping;WARNING;SOFT;1ING WARNING - Packet loss = 60%, RTA = 46.90 ms
[Sun Apr 13 18:57:51 2014] SERVICE ALERT: 242.103;checkping;WARNING;SOFT;1ING WARNING - Packet loss = 50%, RTA = 41.30 ms
[Sun Apr 13 18:57:52 2014] SERVICE ALERT: 242.110;checkping;WARNING;SOFT;1ING WARNING - Packet loss = 50%, RTA = 40.53 ms
[Sun Apr 13 18:58:14 2014] SERVICE ALERT: 242.109;check-host-alive;WARNING;SOFT;1ING WARNING - Packet loss = 81%, RTA = 43.89 ms
[Sun Apr 13 18:58:15 2014] SERVICE ALERT: dx-144.8;check-c-disk;WARNING;SOFT;1;No data was received from host!
[Sun Apr 13 18:58:32 2014] SERVICE ALERT: 242.103;checkping;WARNING;SOFT;2ING WARNING - Packet loss = 70%, RTA = 42.57 ms
[Sun Apr 13 18:58:33 2014] SERVICE ALERT: 242.110;checkping;WARNING;SOFT;2ING WARNING - Packet loss = 80%, RTA = 44.41 ms
[Sun Apr 13 18:58:38 2014] SERVICE ALERT: js-144.28;checkPro-hqc;WARNING;SOFT;1;No data was received from host!
[Sun Apr 13 18:58:52 2014] SERVICE ALERT: IIS242.209;checkCPU;WARNING;SOFT;2;could not fetch information from server
[Sun Apr 13 18:58:55 2014] SERVICE ALERT: IIS242.240;check-host-alive;WARNING;SOFT;1ING WARNING - Packet loss = 81%, RTA = 43.90 ms
[Sun Apr 13 18:58:06 2014] SERVICE ALERT: 242.108;check6501;CRITICAL;SOFT;1;Connection timed out
[Sun Apr 13 18:58:07 2014] SERVICE ALERT: dx-144.23;CheckHqservice;CRITICAL;HARD;1;Using service TCP
[Sun Apr 13 18:58:07 2014] SERVICE ALERT: dx-144.12;check-d-disk;CRITICAL;SOFT;1;Connection timed out
[Sun Apr 13 18:58:10 2014] SERVICE ALERT: js-144.28;CheckHqservice;CRITICAL;HARD;1;Using service TCP
[Sun Apr 13 18:58:10 2014] SERVICE ALERT: dx-144.12;check-c-disk;CRITICAL;SOFT;1;Connection timed out
[Sun Apr 13 18:58:15 2014] SERVICE ALERT: js-144.28;checkCPU;CRITICAL;SOFT;1;Connection timed out
[Sun Apr 13 18:58:16 2014] SERVICE ALERT: dx-144.12;checkPro-hqc;CRITICAL;SOFT;1;Connection timed out
[Sun Apr 13 18:58:17 2014] SERVICE ALERT: dx-144.23;checkCPU;CRITICAL;SOFT;1;CRITICAL - Socket timeout after 30 seconds
[Sun Apr 13 18:58:19 2014] SERVICE ALERT: 242.108;check cpu load;CRITICAL;SOFT;1;CHECK_NRPE: Socket timeout after 10 seconds.
[Sun Apr 13 18:58:23 2014] SERVICE ALERT: dx-144.23;check-c-disk;CRITICAL;HARD;2;Connection timed out
[Sun Apr 13 18:58:26 2014] SERVICE ALERT: dx-144.8;checkPro-hqc;CRITICAL;SOFT;1;Connection timed out
[Sun Apr 13 18:58:30 2014] SERVICE ALERT: dx-144.23;checkCPU;CRITICAL;HARD;2;Connection timed out
[Sun Apr 13 18:58:31 2014] SERVICE ALERT: dx-144.7;check-c-disk;CRITICAL;HARD;2;Connection timed out
[Sun Apr 13 18:58:35 2014] SERVICE ALERT: dx-144.8;CheckHqservice;CRITICAL;HARD;1;Using service TCP

我的需求是：
我想分时间段（最好自己能定义例如: 09:00:00~13:15）统计一下分别有多少次 DOWN 和 WARNING 和 CRITICAL，最好结果能导入到xls表格。
谢谢

yestreenstars

禁用表情~{:2_171:}

ly5066113

回复 1# kwingart


try:

1. awk -vst='09:00:00' -vet='13:15:00' '{k=$1" "$2" "$3" "st"~"et" "$5}$4>=st&&$4<=et{if(/DOWN/)a[k" DOWN"]++;if(/WARNING/)a[k" WARNING"]++;if(/CRITICAL/)a[k" CRITICAL"]++}END{for(i in a)print i,a[i]}' file

复制代码

kwingart

有用，谢谢。结果如下：
[Wed Apr 16 09:00:00~13:15:00 2014] CRITICAL 1006
[Tue Apr 15 09:00:00~13:15:00 2014] CRITICAL 573
[Mon Apr 14 09:00:00~13:15:00 2014] DOWN 48
[Sun Apr 13 09:00:00~13:15:00 2014] CRITICAL 271
[Sat Apr 19 09:00:00~13:15:00 2014] DOWN 1
[Wed Apr 16 09:00:00~13:15:00 2014] WARNING 185
[Mon Apr 14 09:00:00~13:15:00 2014] WARNING 136
[Mon Apr 14 09:00:00~13:15:00 2014] CRITICAL 583
[Sun Apr 13 09:00:00~13:15:00 2014] WARNING 66
[Sat Apr 19 09:00:00~13:15:00 2014] CRITICAL 47
[Fri Apr 18 09:00:00~13:15:00 2014] WARNING 10
[Sat Apr 19 09:00:00~13:15:00 2014] WARNING 3
[Thu Apr 17 09:00:00~13:15:00 2014] DOWN 12
[Thu Apr 17 09:00:00~13:15:00 2014] CRITICAL 441
[Thu Apr 17 09:00:00~13:15:00 2014] WARNING 82
[Tue Apr 15 09:00:00~13:15:00 2014] WARNING 108
[Tue Apr 15 09:00:00~13:15:00 2014] DOWN 28
[Fri Apr 18 09:00:00~13:15:00 2014] DOWN 3
[Fri Apr 18 09:00:00~13:15:00 2014] CRITICAL 396
[Sun Apr 13 09:00:00~13:15:00 2014] DOWN 19
[Wed Apr 16 09:00:00~13:15:00 2014] DOWN 105

我能不能在这个基础上再“无耻”的提个需求，就是需要显示结果如下（也就是在给定的时间段中按down critical warning加总来统计）

09:00:00~13:15:00 2014  DOWN N次(加总)
09:00:00~13:15:00 2014  CRITICAL N次(加总)
09:00:00~13:15:00 2014  WARNING N次(加总)


谢谢哈

liaosnet

不能老让大家帮你做作业~

kwingart

唉，对awk真不熟悉，又急着用。以后我会多来论坛，多贡献我知道的。谢谢了

kwingart

不好意思，还得加个需求，需要 WARNING CRITICAL前面的两个字段 主机名 和 chech方式，例如 dx-144.23;CheckHqservice;CRITICAL ,DOWN 前面只有一个字段

最后结果最好显示如下：

09:00:00~13:15:00 2014  check_North DOWN N次(加总)
09:00:00~13:15:00 2014  242.103 DOWN N次(加总)
...
09:00:00~13:15:00 2014  dx-144.23 CheckHqservice CRITICAL N次(加总)
...
09:00:00~13:15:00 2014  IIS242.240 checkping WARNING N次(加总)
...

难度提高了不少，辛苦了

damcool

这个好像要在nagios里配置的，象你现在这样做，要nagios干吗？

Herowinter

回复 7# kwingart
没大看明白这需求，这最后次数怎么统计的。
先按WARNNING CRITICAL DOWN，再看
不同的check方式和主机?


   

zxy877298415

回复 4# kwingart
直接把变量k中的$3去掉就可以了！