linux - 有人可以帮我将每小时和每天的日志文件分成一个单独的文件吗？

Question

我想要一个脚本从文件 xyz.rawlog 中提取日志，然后创建一个包含名为:

Arp-14-00.rawlog
Apr-14-01.rawlog
Full example: 
~/xyz/Apr-14-02.rawlog

一个可能的问题:日志行可能在日期字段中有前导 0，或者它可能被隔开。

Example:
Apr 01 12:
Apr  1 12:

示例日志:

Apr 14 02:35:33 DC501.xx.org/10.1.7.145/1.13.136.2 MSWinEventLog,4,Security,3959142,Tue Apr 14 02:35:32 2015,4769,Microsoft-Windows-Security-Auditing,XX.ORG\PereyrR1@XX.ORG,N/A,Success Audit,DC501.xx.org,Kerberos Service Ticket Operations,,A Kerberos service ticket was requested. Account Information: Account Name: PereyrR1@XX.ORG Account Domain: XX.ORG Logon GUID: {2F6FCDED-FBA0-DBF5-88D2-0B048E612E21} Service Information: Service Name: AHCTXXML501$ Service ID: ... –  Joshua C. 44 mins ago  

Apr 14 04:32:16 1232-devr01/127.0.0.1/1.14.0.65 kernel: iptables:IN= OUT=upstream1 SRC=2.7.1.238 DST=207.188.35.17 EN=52 TOS=0x00 PREC=0x00 TTL=64 ID=2574 DF PROTO=TCP SPT=34030 DPT=61613 WINDOW=112 RES=0x00 ACK PSH FIN URGP=0 –

这就是我想要的命令语法。

 ~/Logsplit.sh xyz

工作脚本:

#/bin/bash
mkdir $1
awk -v fpath="$1" -F":" '{ 
    filename = fpath "/" gensub("[ ]+", "-", "g", $1) ".rawlog"; 
    print >> filename
}' $1.rawlog

exit;

Answer 1

如果我没有正确理解你的问题，你想按日期拆分内容，将整行内容插入到新文件中。你可以这样做:

`

mkdir $1
awk -v fpath="$1" -F":" '{ 
    filename = fpath "/" gensub("[ ]+", "-", "g", $1) ".rawlog"; 
    print >> filename
}' $1.rawlog

`