☰

与えられた文字列の後に文字列をキャッチする方法

tag-icon • tag-icon grep logs
与えられた文字列の後に文字列をキャッチする方法

次の内容を含むログファイルmyfile.logがあります。

Thu Jun 04 09:02:05 2020
Closing scheduler window
Closing Resource Manager plan via scheduler window
Clearing Resource Manager plan at database via parameter
Thu Jun 04 09:22:50 2020
mystring3: APP failed to died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
Thu Jun 04 09:32:20 2020
Incremental point up to RBA [0x5a5f.43feb8.0], current log tail at RBA [0x5a5f.44d433.0]
Thu Jun 04 09:39:54 2020
mystring3: APP failed died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
Thu Jun 04 09:51:12 2020
mystring1: APP failed check failed to cache
object handle. Error code: 1014
APP connection lost, closing wallet
Thu Jun 04 09:51:18 2020
Errors in file /folder1/folder2/folder3/file.log:
Err-9087: cpu time or run time policy violation
Thu Jun 04 09:52:07 2020
Dumping diagnostic data in directory=[cdmp_20200604095207], requested by (instance=8, osid=313861), summary=[incident=969964].
Thu Jun 04 10:02:24 2020
Incremental point up to RBA [0x5a5f.48846c.0], current log tail at RBA [0x5a5f.4a1de0.0]
TABLE SYS.USER: ADDED INTERVAL PARTITION SYS_P3375 (3814) VALUES LESS THAN (TO_DATE(' 2020-06-11 01:00:00', 'SYYYY-MM-DD HH24:MI:SS', 'CAL=GREGORIAN'))

「mystring」をgrepすると、次の形式で数行が表示されます。

grep -B1 -A2 mystring myfile.log | grep -B1 -A2 mystring myfile.log | grep -B1 -A2 mystring myfile.log | grep "2009年6月4日" -A3

Thu Jun 04 09:22:50 2020
mystring3: APP failed to died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
--
Thu Jun 04 09:39:54 2020
mystring3: APP failed died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
--
Thu Jun 04 09:51:12 2020
mystring1: APP failed check failed to cache
object handle. Error code: 1014
APP connection lost, closing wallet

しかし、上記のタイムスタンプとともに「デルタポイント」のある行が必要な次の形式で行を取得したいと思います。 「ポストライン引数」（-A2）を（-A5）に増やすことはできますが、同じgrepコマンドで名前のある文字列を取得して複数回発生した場合に「増分点」を見逃さないようにするにはどうすればよいですか？ "私の検索文字列の文字列行または特定の時間範囲の行（2009年6月4日）

Thu Jun 04 09:22:50 2020
mystring3: APP failed to died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
Thu Jun 04 09:32:20 2020
Incremental point up to RBA [0x5a5f.43feb8.0], current log tail at RBA [0x5a5f.44d433.0]
--
Thu Jun 04 09:39:54 2020
mystring3: APP failed died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
--
Thu Jun 04 09:51:12 2020
mystring1: APP failed check failed to cache
object handle. Error code: 1014
APP connection lost, closing wallet
Thu Jun 04 10:02:24 2020
Incremental point up to RBA [0x5a5f.48846c.0], current log tail at RBA [0x5a5f.4a1de0.0]

答え1

これを試してみてください。これがあなたに効果があるようです。

$ awk -v d="Jun 04 09" 'BEGIN { n=1;i=1;start=0;split(d,mon);extrahour=mon[1]" "mon[2]" "mon[3]+1;}

/mystring/ { if (i==1 && start == 1 ){ n=split(a,b,"\n");for (j=1;j<n;j++) print b[j];a="";  }

if (start == 1) { print "-----\n"l"\n"$0;n=2;i=1;next} }

/^Incremental/ { if (start==1) { print a"\n"$0;a="";n=1;i=0; }}

{ if( $0 ~ d )start=1; if ( $0 ~ mon[1] &&  ( $0 !~ d && $0 !~ extrahour ) ) {start=0;} 

  if ( start==1 ) {  l=$0; if (n==2) a=a"\n"$0  }

 } ' file | sed /^$/d

-----
Thu Jun 04 09:22:50 2020
mystring3: APP failed to died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
Thu Jun 04 09:32:20 2020
Incremental point up to RBA [0x5a5f.43feb8.0], current log tail at RBA [0x5a5f.44d433.0]
-----
Thu Jun 04 09:39:54 2020
mystring3: APP failed died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
-----
Thu Jun 04 09:51:12 2020
mystring1: APP failed check failed to cache
object handle. Error code: 1014
APP connection lost, closing wallet
Thu Jun 04 09:51:18 2020
Errors in file /folder1/folder2/folder3/file.log:
Err-9087: cpu time or run time policy violation
Thu Jun 04 09:52:07 2020
Dumping diagnostic data in directory=[cdmp_20200604095207], requested by (instance=8, osid=313861), summary=[incident=969964].
Thu Jun 04 10:02:24 2020
Incremental point up to RBA [0x5a5f.48846c.0], current log tail at RBA [0x5a5f.4a1de0.0]

答え2

$ awk -v searchstring=mystring 'print_line; '\
'/^Incremental point/ { print_line=0; print ""; print "------------"; print ""; next; }; '\
'$0 ~ "^" searchstring { print; print_line=1; }' input

mystring3: APP failed to died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
Thu Jun 04 09:32:20 2020
Incremental point up to RBA [0x5a5f.43feb8.0], current log tail at RBA [0x5a5f.44d433.0]

------------

mystring3: APP failed died. Likely the connection
has been lost. PKCS11 function C_EncryptInit returned
PKCS11 error code: 6
APP connection lost, closing wallet
Thu Jun 04 09:51:12 2020
mystring1: APP failed check failed to cache
mystring1: APP failed check failed to cache
object handle. Error code: 1014
APP connection lost, closing wallet
Thu Jun 04 09:51:18 2020
Errors in file /folder1/folder2/folder3/file.log:
Err-9087: cpu time or run time policy violation
Thu Jun 04 09:52:07 2020
Dumping diagnostic data in directory=[cdmp_20200604095207], requested by (instance=8, osid=313861), summary=[incident=969964].
Thu Jun 04 10:02:24 2020
Incremental point up to RBA [0x5a5f.48846c.0], current log tail at RBA [0x5a5f.4a1de0.0]

------------

関連情報