求救，在hp unix 下，如何将日志中当前时间的前一分钟内日志截取出来？

moshangxie

在hp unix 下，如何将日志中当前时间的前一分钟内日志截取出来？
日志按照天生成，格式如下：

Mon Nov 30 08:11:00 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)
Mon Nov 30 08:12:10 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)
Mon Nov 30 08:12:12 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)
Mon Nov 30 08:12:20 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)
Mon Nov 30 08:13:01 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)
Mon Nov 30 08:13:06 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)
Mon Nov 30 08:15:00 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)
Mon Nov 30 08:15:23 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)
Mon Nov 30 08:15:25 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)
Mon Nov 30 08:15:40 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)
Mon Nov 30 08:15:43 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)

例如，当前时间为Mon Nov 30 08:16:43 2015 ，如何将Mon Nov 30 08:15:00 2015 到Mon Nov 30 08:14:00 2015  之间的 Auth次数打印出来，谢谢

Herowinter

回复 1# moshangxie

我觉得是这样, 未测试.

1. awk '{cmd="date -d\""$1" "$2" "$3" "$4" "$5"\" +%s";cmd|getline t;t=systime()-t;if(t>0&&t<=60)print;close(cmd)}' urfile

复制代码

moshangxie

回复 2# Herowinter
hp unix 下没有 date -d，以及systime()语法

   

Herowinter

回复 3# moshangxie

自己进行日期换算吧, 参考这个帖子.
http://bbs.chinaunix.net/thread-1772999-1-1.html

   

jcdiy0601

没UNIX没法测试

jason680

>> 例如，当前时间为Mon Nov 30 08:16:43 2015 ，如何将Mon Nov 30 08:15:00 2015 到Mon Nov 30 08:14:00 2015  之间的 Auth次数打印出来，谢谢


modify by yourself
$time=1448842603
change to
$time=time


$ perl -MPOSIX -lane 'BEGIN{$time=1448842603;print "time=",strftime("%c",localtime($time));$S=(int($time/60)-2)*60;$E=$S+60;($s,$e)=map{strftime("%c",localtime($_))}($S,$E);print "$s\n$e"}{$t="@F[0..4]"; print if($s lt $t && $t le $e)}' FILE
time=Mon Nov 30 08:16:43 2015
Mon Nov 30 08:14:00 2015
Mon Nov 30 08:15:00 2015
Mon Nov 30 08:15:00 2015 : Auth: Login OK: [aaa9999/999999] (from client localhost port 0)

扯淡的青春要扯淡对待

1.感觉sed -n '//,//p' 稍微简单
2.awk '{a=$4;gsub(/:/,"",a);if (a>=081400&&a<=081500){print $0}}'  日志文件

dn833

1. 
   
2. grep -c '^Mon Nov 30 08:1[45]:[0-5][0-6] : Auth'

复制代码