执行命令从 Unix 服务器读取日志文件

Question

我正在尝试读取日志文件以提取在特定时间生成的异常。 我已经执行了下面提到的命令来提取异常，但它会获取半异常字符串，因为 ThreadPool.java:1593) 文本在该字符串中包含 2 次。

awk -v from='09/02/21 06:41:15:738' -v to='ThreadPool.java:1593)' '$0 ~ from ,$0 ~ to  {print $0}' mylog.log

示例日志文件。

  [09/02/21 06:41:15:738 IST] ERROR root - Error creating request
            org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
            org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
            at com.abc.tx.util.ThreadPool$Worker.run(ThreadPool.java:1593)      Caused by :             org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
            org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
            at com.abc.tx.util.ThreadPool$Worker.run(ThreadPool.java:1593)

从命令接收到的输出

[09/02/21 06:41:15:738 IST] ERROR root - Error creating request
            org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
            org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
            at com.abc.tx.util.ThreadPool$Worker.run(ThreadPool.java:1593)

给定的命令跳过下面的日志

Caused by :             org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
            org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
            at com.abc.tx.util.ThreadPool$Worker.run(ThreadPool.java:1593)

需要帮助才能从日志文件中提取完整的跟踪记录。

提前致谢

Answer 1

我会尝试一些更通用的东西：

awk \
    -v from='09/02/21 06:41:15:738' \
    -v to='^( |(Caused by))' '$0 ~ from , $0 !~ from && $0 !~ to {print $0}' \
    mylog.log \
    | sed '$d'

示例mylog.log:

AAA TEST AAA
BBB TEST BBB
[09/02/21 06:41:15:738 IST] ERROR root - Error creating request
            org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
            org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
            at com.abc.tx.util.ThreadPool$Worker.run(ThreadPool.java:1593)
Caused by :             org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
            org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
            at com.abc.tx.util.ThreadPool$Worker.run(ThreadPool.java:1593)
CCC TEST CCC
DDD TEST DDD

GNU awk 输出：

$ awk \
    -v from='09/02/21 06:41:15:738' \
    -v to='^( |(Caused by))' '$0 ~ from , $0 !~ from && $0 !~ to {print $0}' \
    mylog.log \
    | sed '$d'
[09/02/21 06:41:15:738 IST] ERROR root - Error creating request
            org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
            org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
            at com.abc.tx.util.ThreadPool$Worker.run(ThreadPool.java:1593)
Caused by :             org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
            org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
            javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
            at com.abc.tx.util.ThreadPool$Worker.run(ThreadPool.java:1593)

解释：

我们假设堆栈跟踪的所有后续行都以空格开头（如果需要，我们可以概括并使用[:space:]）而不是寻找异常的特定结尾，因此我们将to 值设置为查找以短语Caused by 的空格开头的行的正则表达式。

然后我们告诉 awk 结束模式是 $0 !~ from && $0 !~ to，这意味着任何看起来不像我们的 from，或者像它以空格开头，或者像它以 Caused by 开头的任何东西。

这也将导致 awk 打印与结束模式匹配的行，即我们不想要的第一行，所以我们用sed '$d' 删除最后一行。